Which versions of Mcp Data Vis are affected by CVE-2026-5322?

CVE-2026-5322 is a remote SQL injection vulnerability in the mcp-data-vis MCP Handler that allows unauthenticated attackers to directly manipulate database queries, potentially compromising…

Is there a public PoC exploit available for CVE-2026-5322?

Yes, a public proof-of-concept exploit is available for CVE-2026-5322. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5322?

Within 24 hours: Identify all deployments of mcp-data-vis MCP Handler in your environment and isolate systems running vulnerable versions from production networks if feasible. Within 7 days: Contact the vendor (AlejandroArciniegas) and monitor the project repository for security patches or workarounds; implement network-level access controls to restrict inbound requests to the affected handler to trusted sources only. Within 30 days: Evaluate replacement solutions or architectural redesign to eliminate the dependency on this unmaintained product, as the vendor has not responded to security disclosures and uses a rolling release model without versioning, preventing reliable patching.

Mcp Data Vis CVE-2026-5322

Q: What is the CVSS score of CVE-2026-5322?

CVE-2026-5322 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18126 MEDIUM

SQL Injection (CWE-89)

2026-04-02 VulDB

GHSA-95rp-mv97-7vqq

SQLi Mcp Data Vis

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 05:45 euvd

EUVD-2026-18126

Analysis Generated

Apr 02, 2026 - 05:45 vuln.today

CVE Published

Apr 02, 2026 - 05:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability has been found in AlejandroArciniegas mcp-data-vis bc597e391f184d2187062fd567599a3cb72adf51/de5a51525a69822290eaee569a1ab447b490746d. This affects the function Request of the file src/servers/database/server.js of the component MCP Handler. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in AlejandroArciniegas mcp-data-vis MCP Handler allows remote unauthenticated attackers to manipulate database queries via the Request function in src/servers/database/server.js. Publicly available exploit code exists. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	Real-world risk is elevated due to converging factors: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote exploitation with low complexity requiring no authentication or user interaction, making this trivially exploitable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote attacker identifies an exposed mcp-data-vis instance and sends crafted HTTP requests to the MCP Handler endpoint, injecting malicious SQL payloads into parameters processed by the Request function in src/servers/database/server.js. Because the function fails to sanitize input, the attacker's SQL commands execute with database privileges, allowing them to extract sensitive data via UNION-based injection, modify records through UPDATE statements, or drop tables to cause service disruption. …
Remediation	Users should immediately review the GitHub repository at https://github.com/AlejandroArciniegas/mcp-data-vis for any commits addressing SQL injection in src/servers/database/server.js post-dating the vulnerable commits (bc597e391f184d2187062fd567599a3cb72adf51 and de5a51525a69822290eaee569a1ab447b490746d). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all deployments of mcp-data-vis MCP Handler in your environment and isolate systems running vulnerable versions from production networks if feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-5322 vulnerability details – vuln.today

Back