Live › vulnerability › CVE-2026-116053
Go to dashboardmycli is a command-line MySQL client, and its source-command safety check in mycli/packages/special/source.py can be bypassed. A crafted input can lead to OS command injection that runs with the privileges of the user running mycli.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Only people who run mycli on a local machine with the affected versions are exposed, and the attack needs local access. Servers and applications that do not use mycli as an interactive client are not affected by this entry. Users who do not run these versions can skip it.
No product ranges from the sources yet.
mycli --version and compare against the affected range up to 2.29.4 and 2.30.1.pip show mycli or which mycli.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116053")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.