CVE-2026-61789

DBHub, a database MCP server, contains a vulnerability in its MySQL and MariaDB connectors prior to version 0.22.6 . The root cause is an interpretation conflict in src/utils/sql-parser.ts, where scanSingleLineComment incorrectly treats every double dash (--) as a comment start, unlike the actual...

CVE-2026-61789 DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In src/utils/sql-parser.ts, scanSingleLineComment treats every double dash as a comment start, whereas MySQL and...