CVE-2026-118378
HIGH
NVD
CVSS Score
7.8
Severity
HIGH
Published
Oct 28, 2026
Vendor
unknown
Description
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
References
- https://github.com/TabularisDB/tabularis
- https://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/drivers/sqlite/mod.rs#L92-L105
- https://github.com/TabularisDB/tabularis/commit/fd1bdbbae35e5367c32d1e7fe9c44cb1b6875d74
- https://github.com/TabularisDB/tabularis/releases/tag/v0.28.0
- https://github.com/TabularisDB/tabularis/security/advisories/GHSA-xrx3-j98v-67x9