This vulnerability exists in AlejandroArciniegas mcp-data-vis within the Request function of src/servers/database/server.js, where improper input handling leads to SQL injection. An attacker can remotely exploit this flaw without privileges or user interaction, potentially impacting data confidentiality and integrity. The product's rolling release model means affected versions are identified by commit hashes rather than traditional version numbers. The vendor has not provided a response or patch, and no official remediation guidance is available.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may result in unauthorized data disclosure, data modification, or other database impacts. The CVSS 4.0 base score of 6.9 reflects a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patches or fixes are publicly available, users should monitor official channels for updates. In the meantime, consider implementing input validation or web application firewalls to mitigate SQL injection risks specific to the affected component.