Threats tagged 'ghsa-7qqr-jg5c-wx37'

A SQL injection vulnerability exists in TimBroddin astro-mcp-server versions up to 1.1.1 in the MCP Tool Query Construction component. The flaw arises from improper handling of the request.params.arguments input, allowing remote attackers to manipulate SQL queries. Public exploit code is available, but no official patch or vendor response has been provided yet. The vulnerability has a medium severity rating with a CVSS score of 6.3.