CVE-2026-47252

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...

CVE-2026-47252

Anyquery (a Go-based SQL query engine on SQLite) prior to 0.4.5 is vulnerable to AppleScript/JXA code injection in its macOS browser plugins. The chrome_tabs plugin (and equivalent Brave, Edge, and Safari variants) interpolates a SQL-controlled URL directly into AppleScript or JXA source via fmt....

Vulnerability of the clear_plugin_cache() function in the SQL database of Anyquery, allowing a hacker to cause a service failure

The vulnerability of the clearplugincache function in the SQL database Anyquery is related to an incorrect limitation on the path name of the catalog. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-54628

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

CVE-2026-54629

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...

CVE-2026-50006

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...

CVE-2026-54628 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

CVE-2026-54628

Anyquery is a Go-based SQL query engine built on SQLite. In server mode (anyquery server), the unauthenticated MySQL-compatible port allows remote attackers to create virtual tables using modules such as json_reader and log_reader, which internally use go-getter to fetch arbitrary URLs. Because o...

CVE-2026-54628 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

CVE-2026-50006

CVE-2026-50006 affects Anyquery (github.com/julien040/anyquery), an SQL query engine built on SQLite. In server mode prior to 0.4.5 , the MySQL-compatible port forwards unauthenticated SQL to SQLite without restricting ATTACH DATABASE filesystem targets. A remote, unauthenticated attacker can spe...

CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...

CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...

CVE-2026-54629 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...

CVE-2026-54629

Anyquery (an SQL query engine built on SQLite) prior to 0.4.5 is vulnerable to Local File Read via unrestricted SQLite virtual table modules in server mode. When launched in server mode, the MySQL-compatible port accepts unauthenticated connections that can execute CREATE VIRTUAL TABLE statements...

CVE-2026-54629 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...

CVE-2026-47253

Anyquery (an SQL query engine built on SQLite) is vulnerable to path traversal in the clear_plugin_cache(plugin) SQL scalar function (namespace/other_functions.go). Prior to 0.4.5 , the caller-controlled plugin argument is passed through path.Join to os.RemoveAll without rejecting .. segments, al...

CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...

GO-2026-5988 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery

Anyquery: Server-Side Request Forgery SSRF via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...

GO-2026-5979 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode in github.com/julien040/anyquery

Anyquery: Arbitrary File Write AFW which could lead to Remote Code Execution RCE via Unrestricted ATTACH DATABASE in Server Mode in github.com/julien040/anyquery...

GO-2026-5990 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery

Anyquery: Local File Read LFR via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...