Skip to content
OpenAdvisories

Package · Go

github.com/julien040/anyquery

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.6
    CVE-2026-54628

    Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible server port without restricting outbound d…

    julien040 anyquery github.com/julien040/anyquery Go
  • Critical 9.1
    CVE-2026-50006

    Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path …

    julien040 anyquery github.com/julien040/anyquery Go
  • High 7.5
    CVE-2026-54629

    Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or direc…

    julien040 anyquery github.com/julien040/anyquery Go
  • High 7.3
    CVE-2026-47253

    Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traver…

    julien040 anyquery github.com/julien040/anyquery Go