Threats tagged 'ghsa-v867-6qx2-gwmg'

Tabularis versions before 0.28.0 have an SQL injection vulnerability in the SQLite driver. This flaw allows MCP clients to execute stacked SQL statements by manipulating the table_name parameter in the describe_table tool. Exploitation can bypass read-only mode and write approval, enabling attackers to read, modify, or delete SQLite data. The vulnerability carries a high severity rating with a CVSS score of 7.8.