Threat database

CVE-2026-116053 is an OS command injection vulnerability in the dbcli mycli tool affecting versions 2.29.0 through 2.30.1. The flaw exists in the function source_special_command_is_safe within the source.py file of the Whitelist component. An attacker with local access can exploit this weakness to execute arbitrary OS commands. Public exploit code is available, but no vendor response or patch has been provided. The vulnerability has a medium severity rating with a CVSS score of 4.8.