Skip to content
OpenAdvisories

Package · npm

@bytebase/dbhub

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.1
    CVE-2026-61789

    DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

    DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment` treats every double d…

    bytebase dbhub @bytebase/dbhub npm
  • High 7.4
    CVE-2026-61788

    @bytebase/dbhub's read-only mode does not prevent database writes

    DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default…

    bytebase dbhub @bytebase/dbhub npm
  • Critical 9.3
    CVE-2026-61742

    DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

    DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The…

    bytebase dbhub @bytebase/dbhub npm