CVE-2026-118378: TabularisDB tabularis: Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute…

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...