GHSA-j656-3hf2-fvjc
The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements (for example DROP TABLE), which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent.
Root cause
The problem is a mismatch between how DBHub's SQL parser handles single-line comments and how MySQL and MariaDB actually parse them.
In src/utils/sql-parser.ts, scanSingleLineComment treats "--" as the start of a comment no matter what character follows it. MySQL and MariaDB only begin a "--" comment when the two dashes are followed by whitespace, a control character, or the end of the line. Otherwise the dashes are read as two minus signs and the rest of the line is ordinary SQL.
The read-only check in src/tools/execute-sql.ts splits the input and validates each statement with isReadOnlySQL, but the connector then executes the original, unmodified string. The MySQL and MariaDB connectors open their connection pool with multipleStatements: true (src/connectors/mysql/index.ts:54 and src/connectors/mariadb/index.ts:53) and run the whole string in a single call.
Because of this, the following payload:
SELECT 1--1;DROP TABLE victim
is seen by DBHub as a single SELECT statement, since everything after "--" is treated as a comment and the read-only check passes. MySQL and MariaDB instead parse it as "SELECT 1 - -1" followed by "DROP TABLE victim" and execute both statements.
Proof of concept
Impact
Read-only mode is the control operators rely on to let an assistant read from a database without being able to change it. With this bypass, anyone who can influence the SQL the assistant sends, most realistically through prompt injection in content the assistant reads, can perform writes and destructive DDL against MySQL and MariaDB. PostgreSQL is not affected by this path, because it treats "--" as a comment regardless and executes each split statement individually.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
| Product | Affected versions | Fixed in | Source |
|---|---|---|---|
| @bytebase/dbhubnpm | < 0.22.6 | 0.22.6 | GitHub |
Affected code (current main, commit e99c3aa9, package version 0.22.3)
Suggested fix
The most reliable fix is to stop executing the original string: run only the statements that were validated, and disable multipleStatements on the MySQL and MariaDB connections unless it is genuinely required. As defense in depth, make the comment scanner dialect-aware so that for MySQL and MariaDB "--" only starts a comment when it is followed by whitespace, a control character, or the end of the line, similar to the handling already in place for MySQL conditional comments.
EPSS is only published for CVE identifiers.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security