EUVD-2026-35108
GHSA-mvq4-39wx-6h5g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.
AnalysisAI
SQL injection in designcomputer mysql-mcp-server (versions up to 0.2.2) allows authenticated remote attackers to execute arbitrary SQL via a crafted mysql:// URI passed to the read_resource function in server.py. The vulnerability stems from insufficient validation of the table-name segment in mysql://database/<name> URIs before interpolation into MySQL queries. A publicly available proof-of-concept exploit exists (GitHub issue #89); the issue is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. An official fix was released as v0.3.0 (also backported to v0.2.3).
Technical ContextAI
mysql-mcp-server is a Python implementation of the Model Context Protocol (MCP) that exposes a MySQL database to AI agents and LLM-based toolchains. The affected component is the read_resource handler in src/mysql_mcp_server/server.py, which processes resource URIs of the form mysql://database/<table_name>. Prior to the fix, the table_name segment extracted from uri_str was interpolated into SQL queries without strict allowlist validation, satisfying CWE-89 (Improper Neutralization of Special Elements in SQL Commands). The CPE cpe:2.3:a:designcomputer:mysql-mcp-server:*:*:*:*:*:*:*:* covers all versions up to and including 0.2.2. The fix introduced a validate_identifier() utility enforcing the strict regex ^[a-zA-Z0-9_$]+$ and backtick-quoting of identifiers, eliminating the injection surface.
RemediationAI
Upgrade to mysql-mcp-server version 0.3.0 (or at minimum 0.2.3), available via pip: pip install --upgrade mysql-mcp-server. The fix is confirmed in commit 080bef9a96d625ce0dfbde573a08b93497871981 and tagged release v0.3.0 at https://github.com/designcomputer/mysql_mcp_server/releases/tag/v0.3.0. If immediate upgrade is not possible, restrict access to the MCP server to trusted, fully authenticated clients only, and avoid exposing the server to any path where untrusted input (such as LLM-generated or user-supplied strings) can reach the uri_str argument of read_resource. Deploying in SSE/HTTP mode (MCP_TRANSPORT=sse) with the default MCP_SSE_HOST=127.0.0.1 binding limits network exposure as a partial compensating control, but does not eliminate the injection flaw. The Docker hardening in v0.3.0 (non-root appuser, removed ENV secrets) should also be adopted if running containerized.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today