A vulnerability in DBHub's MySQL and MariaDB connectors allows bypass of read-only SQL validation due to incorrect handling of single-line comments. The DBHub SQL parser treats any "--" as a comment start regardless of the following character, whereas MySQL and MariaDB require whitespace or control characters after "--" to start a comment. This mismatch enables execution of arbitrary write and DDL statements in read-only mode, such as DROP TABLE. The issue affects DBHub versions prior to 0.22.6 and is fixed in 0.22.6.