This vulnerability in wbbeyourself MAC-SQL up to commit 31a9df5e0d520be4769be57a4b9022e5e34a14f4 affects the _execute_sql function within core/agents.py of the Refiner Agent component. It allows remote attackers to perform SQL injection by manipulating input to the function, potentially compromising the database. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low impacts on confidentiality, integrity, and availability. The vendor has not provided a patch or advisory, and the product’s rolling release approach complicates version tracking. Public exploit code is available, but no active exploitation is confirmed.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with low confidentiality, integrity, and availability impacts. No evidence of active exploitation in the wild has been reported.

No official patch or remediation guidance is currently available from the vendor, who has not responded to disclosure attempts. Users should monitor the vendor’s channels for updates due to the rolling release model. Until a fix is released, consider restricting network access to the vulnerable component and applying any available input validation or query parameterization as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.