Description
A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| designcomputer | mysql-mcp-server | 0.2.0, 0.2.1, 0.2.2 | 0.3.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mysql-mcp-server | < 0.3.0 | 0.3.0 | GHSA-mvq4-39wx-6h5g |
References
- VDB-369146 | designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection vdb-entry technical-description
- VDB-369146 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-11529 | CVE Analysis and Report third-party-advisory
- Submit #836490 | designcomputer mysql_mcp_server 0.2.2 SQL Injection third-party-advisory
- https://github.com/designcomputer/mysql_mcp_server/issues/89 exploit issue-tracking
- https://github.com/designcomputer/mysql_mcp_server/pull/86 issue-tracking patch
- https://github.com/designcomputer/mysql_mcp_server/commit/080bef9a96d625ce0dfbde573a08b93497871981 patch
- https://github.com/designcomputer/mysql_mcp_server/releases/tag/v0.3.0 patch