CVE-2026-47252

Name of the Vulnerable Software and Affected Versions anyquery version 0.4.4

Description The chrome tabs plugin (including Brave, Edge, and Safari variants) allows for AppleScript and JXA code injection on macOS hosts. The issue occurs because a SQL-controlled url value is interpolated directly into an AppleScript template without proper escaping before being executed via the osascript command. An authenticated user with the ability to issue SQL INSERT or UPDATE statements against the chrome tabs virtual table can use a payload containing newlines to break out of the intended script structure and execute arbitrary OS-level commands using do shell script. This can be exploited via the local CLI or the HTTP server interface, granting the attacker the privileges of the anyquery process, including access to the file system and keychain prompts.

Recommendations For version 0.4.4, escape double-quote and newline characters in the url value before interpolation in plugins/chrome/tabs.go at lines 141 and 169, or pass the URL as an AppleScript variable using the argv mechanism to avoid string interpolation. Validate that the url conforms to allowed schemes such as https://, http://, or chrome:// before processing. As a temporary mitigation, restrict access to the chrome tabs virtual table to prevent unauthorized INSERT or UPDATE operations.