CVE-2026-61789

Name of the Vulnerable Software and Affected Versions DBHub versions prior to 0.22.6

Description Read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. The scanSingleLineComment function in src/utils/sql-parser.ts incorrectly treats every double dash as the start of a comment, whereas MySQL and MariaDB require a following whitespace, control character, or the end of the line. While the read-only check in src/tools/execute-sql.ts uses isReadOnlySQL to validate split statements, the connectors in src/connectors/mysql/index.ts and src/connectors/mariadb/index.ts execute the original string with multipleStatements enabled. Consequently, a double dash followed by a non-whitespace character can hide a write or destructive DDL (Data Definition Language) statement from the validator, while the database interprets the dashes as minus operators and executes both statements. This allows an attacker to bypass read-only mode to modify or drop database data via prompt injection, depending on the database account privileges.

Recommendations Update to version 0.22.6.