CVE-2026-118378GHSA-xrx3-j98v-67x9
Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name
TabularisDB tabularis
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 0.28.0tabularisCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
Text from CVE List
Affected versions 1
- tabularisaffected: 0.10.0 before 0.28.0CVE List
References 6
- github.com/TabularisDB/tabularis/commit/fd1bdbbae35e5367c32d1e7fe9c44cb1b6875d74Fixvia CVE List
- github.com/TabularisDB/tabularis/releases/tag/v0.28.0Fixvia CVE List
- github.com/TabularisDB/tabularis/security/advisories/GHSA-xrx3-j98v-67x9Advisoryvia CVE List
- vulncheck.com/advisories/tabularis-before-0.28.0-sql-injection-via-mcp-describe-table-table-nameAdvisoryvia CVE List
- github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/drivers/sqlite/mod.rs#L92-L105Referencevia CVE List
- github.com/TabularisDB/tabularisReferencevia CVE List