EUVD-2026-111554
GHSA-v867-6qx2-gwmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUntrusted content reaches MCP-connected AI agent
-
DeliveryAgent invokes describe_table with crafted table_name
-
ExploitPayload closes quoted PRAGMA argument, appends stacked SQL
-
Executionsqlx SQLite backend executes second statement
-
ImpactArbitrary read/modify/DROP bypassing read-only mode and write approval
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a SQLite connection (the MySQL and Postgres drivers correctly use bound parameters and are not affected) exposed through Tabularis's built-in MCP server, reached by a local MCP client over stdio JSON-RPC. The attacker must be able to influence the table_name argument an AI agent passes to the describe_table MCP tool - the realistic route is indirect prompt injection via untrusted content the agent is asked to process. LIMITING FACTORS: local access only (no network socket); an AI-agent/user session must actually issue the describe_table call (UI:P/Required); and the impact is scoped to the SQLite databases reachable through that MCP connection. Notably, no special non-default configuration is needed - the flaw works precisely when the product's read-only mode / write-approval gate is enabled, because describe_table (unlike run_query) never calls config::is_connection_readonly or the approval flow. |
| Impact | Signals mostly align toward a genuine, near-term priority rather than a CVSS-inflated non-issue, but with important caveats. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, 8.5) and the independent GHSA estimate (CVSS:3.1 7.8) agree that this is a LOCAL-vector flaw - the vulnerable code runs inside the Tabularis MCP server subprocess reached over local stdio JSON-RPC from an MCP client (Claude Desktop, Cursor, Devin), not over a network socket - so there is no direct remote, pre-auth internet exposure. That tempers raw urgency, but the vulnerability's whole significance is that it defeats the read-only-mode / write-approval control Tabularis ships specifically to contain a semi-trusted AI agent: PR:N is justified because no privilege beyond ordinary MCP tool access is needed, and describe_table never invokes the approval gate that run_query does. UI is Passive/Required because a user's agent session must actually issue the describe_table call - the realistic trigger is indirect prompt injection via untrusted content the agent processes. vuln.today assigns a 'this_week' decision label (not act_now/emergency), consistent with a high-impact but locally-scoped, interaction-dependent issue. CONFLICTING/MISSING DATA: no CISA KEV listing and no EPSS score are present in the input, so exploitation probability cannot be quantified; treat exploitation-likelihood claims as unestablished. A detailed PoC is embedded in the advisory, but the researcher could not compile the shipped Tauri/Rust binary and instead verified the mechanism against the pinned sqlx-sqlite 0.8.6 source and libsqlite3 via a ctypes replica - so working exploitation of the actual product is strongly evidenced in mechanism but not demonstrated end-to-end against the binary. |
| Exploit ScenarioDerived | A user connects a SQLite database to Tabularis in read-only mode and exposes it to an AI agent over the built-in MCP server. The agent is asked to summarize untrusted content (e.g., a document or web page) that contains an indirect prompt injection steering it to call the describe_table tool with table_name set to "nonexistent'); DROP TABLE secret;--"; the crafted value closes the quoted PRAGMA argument and appends a stacked statement that sqlx's SQLite backend executes, dropping or modifying data despite read-only mode. A detailed public PoC reference exists in the GHSA advisory; it is not verified as working exploit code against the shipped binary (the researcher reproduced the mechanism against sqlx-sqlite and libsqlite3 rather than the compiled product). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
SQLite SQL injection in Tabularis (TabularisDB) before 0.28.0 lets an MCP client - including an AI agent steered by untrusted content it is processing - execute arbitrary stacked SQL statements through the describe_table tool's table_name argument, reading, modifying or dropping SQLite data entirely outside the product's read-only mode and write-approval gate. Only SQLite connections exposed through Tabularis's built-in MCP server are affected; the MySQL and PostgreSQL drivers use bound parameters and are not vulnerable. The CVE record scores it 8.5 under CVSS v4.0, while our independent CVSS v3.1 assessment scores it 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because exploitation is local-only (stdio JSON-RPC, no network socket) and requires an agent session to actually issue the describe_table call. A working proof of concept is published in the GitHub security advisory GHSA-xrx3-j98v-67x9 - the reporter reproduced the stacked-statement execution against libsqlite3 via a ctypes harness rather than the shipped Tauri binary, so a public PoC reference exists but has not been demonstrated end-to-end against a released build; there is no CISA KEV listing and no public evidence of active exploitation at time of analysis. Per the current priority signal this is scheduled for remediation this week rather than treated as an emergency.
RemediationAI
Upgrade Tabularis to 0.28.0 or later (https://github.com/TabularisDB/tabularis/releases/tag/v0.28.0); the vendor-released patch commit fd1bdbbae35e5367c32d1e7fe9c44cb1b6875d74 converts every affected introspection query to SQLite table-valued pragmas with a bound parameter - SELECT * FROM pragma_table_xinfo(?1), pragma_foreign_key_list(?1), pragma_index_list(?1) and pragma_index_info(?1) - covering get_columns, get_foreign_keys, get_all_columns_batch, get_all_foreign_keys_batch, get_indexes/index_info and get_view_columns, and adds regression tests asserting that names such as "nonexistent'); DROP TABLE users;--" are treated purely as data while quoted names still resolve. Because the flaw is a bypass of Tabularis's MCP safety controls rather than a defect in them, disabling read-only mode or tightening the write-approval setting changes nothing and must not be treated as a workaround; the advisory's own alternative recommendations are to validate table_name against sqlite_master (SELECT name FROM sqlite_master WHERE type='table' AND name = ?1) before use or to quote it as a double-quoted identifier with embedded quotes doubled, and to extend is_connection_readonly / the approval gate to describe_table, list_tables and list_databases so no introspection tool can execute more than the single intended statement. Until a 0.28.0 build is deployed, the only reliable containment is to stop exposing SQLite connections to the built-in MCP server, or to limit those connections to MCP clients and agent sessions that never process untrusted third-party content - both of which remove the agent-over-database workflow the feature exists to provide, and neither protects a deployment where prompt injection into an agent session is plausible. See https://github.com/TabularisDB/tabularis/security/advisories/GHSA-xrx3-j98v-67x9 and https://www.vulncheck.com/advisories/tabularis-before-0.28.0-sql-injection-via-mcp-describe-table-table-name for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 combined with CWE-863 (incorrect authorization). Tabularis's SQLite driver built schema-introspection queries by string interpolation, e.g. format!("PRAGMA table_info('{}')", table_name), at several sites in src-tauri/src/drivers/sqlite/mod.rs (get_columns, get_foreign_keys, get_all_columns_batch, get_all_foreign_keys_batch, get_indexes/index_info and get_view_columns), with no escaping, no binding and no validation of table_name against sqlite_master. Each string was passed to sqlx::query(&query).fetch_all(&pool); the pinned sqlx-sqlite 0.8.6 backend drives sqlite3_prepare_v2 over the prepare-tail and steps every statement it finds in the string, not just the first, so a table_name such as "nonexistent'); DROP TABLE secret;--" closes the quoted PRAGMA argument and appends a second statement that is really executed. The reachable path is the built-in MCP server's tool_describe_table in src-tauri/src/mcp/mod.rs, which takes table_name straight from JSON-RPC arguments and forwards it unmodified to driver.get_columns/get_foreign_keys/get_indexes. Critically, is_connection_readonly and the mcp_approval_mode gate are enforced only inside tool_run_query by classifying the supplied SQL; describe_table, list_tables and list_databases never consult them, so the injection works precisely when the operator has enabled the safety controls that exist to make an MCP-exposed database safe for an AI agent. The identical lookup in the mysql and postgres drivers correctly uses ? / $1 bind parameters, making the SQLite driver the outlier. The fix replaces string-built PRAGMAs with SQLite table-valued pragma functions and a bound argument, e.g. sqlx::query("SELECT * FROM pragma_table_xinfo(?1)").bind(table_name), which treats quotes and semicolons in the identifier as data.
Know when Tabularis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AV:L - code runs in the local MCP subprocess over stdio; UI:R - an agent must issue the tool call; PR:N - only ordinary MCP tool access needed, bypassing the read-only/approval gate; C/I/A:H - stacked statements read, modify, and DROP data.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
Technical POC Analysis
CWE-89 (SQL injection), with a secondary CWE-863 consequence: the read-only-mode / write-approval authorization gate is never consulted on the vulnerable path.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
TabularisDB versions before 0.28.0 contain a high-severity SQL injection vulnerability that allows an MCP client, including AI agents under the influence of untrusted content, to bypass read-only controls and execute arbitrary SQL against SQLite databases. This could enable unauthorized data access, modification, or deletion, directly impacting data integrity and confidentiality for teams relying on Tabularis for SQLite database operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB