Threats affecting pkg:github/dubydu/sqlite-mcp

CVE-2026-7206 is a medium severity SQL injection vulnerability in the dubydu sqlite-mcp product version 0.1.0. The flaw exists in the extract_to_json function within src/entry.py, where manipulation of the output_filename argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication or user interaction. A patch identified by commit a5580cb992f4f6c308c9ffe6442b2e76709db548 has been released to fix the issue. No known exploits are reported in the wild at this time.