{"id":"GHSA-j656-3hf2-fvjc","kind":"vulnerability","aliases":["GHSA-j656-3hf2-fvjc"],"related":[],"title":"DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation","description":"The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements (for example DROP TABLE), which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent.\n\nRoot cause\n\nThe problem is a mismatch between how DBHub's SQL parser handles single-line comments and how MySQL and MariaDB actually parse them.\n\nIn src/utils/sql-parser.ts, scanSingleLineComment treats \"--\" as the start of a comment no matter what character follows it. MySQL and MariaDB only begin a \"--\" comment when the two dashes are followed by whitespace, a control character, or the end of the line. Otherwise the dashes are read as two minus signs and the rest of the line is ordinary SQL.\n\nThe read-only check in src/tools/execute-sql.ts splits the input and validates each statement with isReadOnlySQL, but the connector then executes the original, unmodified string. The MySQL and MariaDB connectors open their connection pool with multipleStatements: true (src/connectors/mysql/index.ts:54 and src/connectors/mariadb/index.ts:53) and run the whole string in a single call.\n\nBecause of this, the following payload:\n\n    SELECT 1--1;DROP TABLE victim\n\nis seen by DBHub as a single SELECT statement, since everything after \"--\" is treated as a comment and the read-only check passes. MySQL and MariaDB instead parse it as \"SELECT 1 - -1\" followed by \"DROP TABLE victim\" and execute both statements.\n\nProof of concept\n\n1) DBHub's own parser. Running splitSQLStatements and isReadOnlySQL from this repository on the payload returns a single statement and readOnly = true, so the query is allowed in read-only mode. The same code correctly rejects \"SELECT 1; DROP TABLE victim\", which confirms that the \"--1\" is what gets through.\n\n2) Execution. Connecting to MariaDB 11.4 with mysql2 and multipleStatements: true (the same option the connector uses) and sending the payload returns 2 for the first statement, which confirms \"--\" was not treated as a comment, and then drops the table. The table exists before the call and is gone afterwards.\n\nImpact\n\nRead-only mode is the control operators rely on to let an assistant read from a database without being able to change it. With this bypass, anyone who can influence the SQL the assistant sends, most realistically through prompt injection in content the assistant reads, can perform writes and destructive DDL against MySQL and MariaDB. PostgreSQL is not affected by this path, because it treats \"--\" as a comment regardless and executes each split statement individually.\n\nAffected code (current main, commit e99c3aa9, package version 0.22.3)\n\n- src/utils/sql-parser.ts — scanSingleLineComment does not require whitespace after \"--\"\n- src/tools/execute-sql.ts — validates the split statements but executes the original string\n- src/connectors/mysql/index.ts and src/connectors/mariadb/index.ts — multipleStatements: true\n\nSuggested fix\n\nThe most reliable fix is to stop executing the original string: run only the statements that were validated, and disable multipleStatements on the MySQL and MariaDB connections unless it is genuinely required. As defense in depth, make the comment scanner dialect-aware so that for MySQL and MariaDB \"--\" only starts a comment when it is followed by whitespace, a control character, or the end of the line, similar to the handling already in place for MySQL conditional comments.","summary":"DBHub's read-only SQL check misreads \"--\" comments that MySQL and MariaDB do not treat as comments, so a payload such as \"SELECT 1--1;DROP TABLE victim\" passes validation and runs a destructive second statement. An attacker who can steer the SQL sent through DBHub, for example via prompt injection into an AI assistant, can write to or drop tables.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@bytebase/dbhub","fixed":["0.22.6"],"affected":"< 0.22.6","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-agents","ai-tooling","cwe-436","cwe-863","dbhub","mariadb","mcp","mysql","npm"],"not_affected_if":["no-mysql-or-mariadb-connector","no-read-only-reliance","postgresql-only"],"how_to_check":"- Check whether the project depends on `@bytebase/dbhub` and run `npm ls @bytebase/dbhub` to read the installed version.\n- Confirm whether a MySQL or MariaDB connector is configured, since the bypass applies only to those connectors.\n- Check whether the installed version is below `0.22.6`.","fix":"- `@bytebase/dbhub` upgrade to `0.22.6` (fixed version per the advisory).","status":"open","published_at":"2026-11-02T17:57:51+00:00","first_seen_at":"2026-11-02T18:01:07+00:00","triaged_at":"2026-11-02T18:01:39+00:00","updated_at":"2026-11-02T18:01:39+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-02T18:01:39Z","model":"claude-haiku-5-5","output":{"fix":"- `@bytebase/dbhub` upgrade to `0.22.6` (fixed version per the advisory).","reach":"network","title":"DBHub: MySQL and MariaDB comments let writes bypass read-only mode","impact":"high","summary":"DBHub's read-only SQL check misreads \"--\" comments that MySQL and MariaDB do not treat as comments, so a payload such as \"SELECT 1--1;DROP TABLE victim\" passes validation and runs a destructive second statement. An attacker who can steer the SQL sent through DBHub, for example via prompt injection into an AI assistant, can write to or drop tables.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["dbhub","mysql","mariadb","mcp","ai-agents","npm"],"confidence":0.85,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs writes and DDL such as DROP TABLE on MySQL or MariaDB","analyst_note":"","how_to_check":"- Check whether the project depends on `@bytebase/dbhub` and run `npm ls @bytebase/dbhub` to read the installed version.\n- Confirm whether a MySQL or MariaDB connector is configured, since the bypass applies only to those connectors.\n- Check whether the installed version is below `0.22.6`.","plain_action":"","needs_analyst":false,"not_affected_if":["postgresql-only","no-read-only-reliance","no-mysql-or-mariadb-connector"],"who_is_affected":"Teams that run DBHub with a MySQL or MariaDB database and rely on its read-only mode to limit what an AI assistant can change. PostgreSQL connectors are not affected by this path, and setups that do not use DBHub's MySQL or MariaDB connectors can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000868,"input_tokens":5323,"output_tokens":671,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':64B,299C,336C,395C '-436':31B '-863':33B '0.22.3':535C '1':63B,298C,335C,349C,387C '11.4':405C '2':400C,422C '3hf2':16A,21A '53':281C '54':278C 'abl':471C 'actual':179C 'affect':510C,527C 'afterward':449C 'agent':26B,155C 'ai':25B,28B,93B,154C 'ai-ag':24B 'ai-tool':27B 'allow':375C 'alreadi':632C 'anyon':478C 'arbitrari':125C 'assist':94B,464C,485C,495C 'attack':77B 'awar':602C 'begin':202C 'bypass':7A,108C,477C 'bytebase/dbhub':23A 'call':290C,445C 'caller':121C 'caus':157C 'chang':473C 'charact':195C,215C,621C 'check':45B,244C,325C 'code':383C,528C 'comment':5A,47B,56B,173C,191C,204C,319C,434C,519C,598C,612C,638C 'commit':531C 'concept':348C 'condit':637C 'confirm':392C,428C 'connect':272C,402C,586C 'connector':114C,258C,269C,415C 'content':493C 'control':214C,457C,620C 'correct':384C 'current':529C 'cwe':30B,32B 'dash':208C,224C 'databas':149C,468C 'dbhub':1A,34B,39B,85B,165C,306C,350C 'ddl':128C,502C 'defeat':135C 'defens':593C 'depth':595C 'destruct':73B,501C 'dialect':601C 'dialect-awar':600C 'disabl':579C 'drop':65B,99B,132C,300C,339C,388C,437C 'e99c3aa9':532C 'end':218C,624C 'everyth':313C 'exampl':87B,131C 'execut':124C,260C,343C,401C,522C,549C,567C 'exist':442C 'expos':151C 'first':425C 'fix':559C,563C 'follow':196C,210C,295C,337C,616C 'fvjc':17A,22A 'genuin':590C 'get':398C 'ghsa':14A,19A 'ghsa-j656-3hf2-fvjc':13A,18A 'gone':448C 'handl':169C,631C 'impact':450C 'individu':526C 'influenc':481C 'inject':90B,491C 'input':249C 'instead':330C 'interpret':6A 'isreadonlysql':255C,357C 'j656':15A,20A 'let':462C 'line':172C,221C,236C,627C 'main':530C 'make':596C 'mariadb':4A,35B,51B,113C,178C,200C,268C,329C,404C,506C,585C,608C 'matter':193C 'mcp':36B 'meant':144C 'minus':229C 'mismatch':162C 'misread':46B 'mode':105C,119C,142C,380C,454C 'multiplestat':275C,409C,556C,580C 'mysql':2A,37B,49B,111C,176C,198C,266C,327C,504C,583C,606C,636C 'mysql2':407C 'npm':38B 'open':270C 'oper':458C 'option':413C 'ordinari':238C 'origin':262C,551C,569C 'otherwis':222C 'packag':533C 'pars':180C,331C 'parser':168C,353C 'pass':68B,326C 'path':513C 'payload':59B,296C,363C,420C 'perform':498C 'place':634C 'pool':273C 'postgresql':507C 'problem':159C 'prompt':89B,490C 'proof':346C 'protect':137C 'provid':146C 'queri':373C 'read':9A,42B,103C,117C,140C,226C,242C,323C,378C,452C,465C,496C 'read-on':8A,41B,102C,116C,139C,241C,322C,377C,451C 'readon':369C 'realist':488C 'regardless':520C 'reject':385C 'reli':459C 'reliabl':562C 'repositori':360C 'requir':540C,591C 'rest':233C 'return':364C,421C 'root':156C 'run':71B,283C,354C,571C 'scanner':599C 'scansinglelinecom':184C,537C 'second':74B 'seen':304C 'select':62B,297C,310C,334C,386C 'send':418C,486C 'sent':83B 'sign':230C 'similar':628C 'sinc':312C 'singl':171C,289C,309C,366C 'single-lin':170C 'split':247C,524C,546C 'splitsqlstat':355C 'sql':11A,44B,82B,167C,239C,483C 'src/connectors/mariadb/index.ts':280C,555C 'src/connectors/mysql/index.ts':277C,553C 'src/tools/execute-sql.ts':246C,543C 'src/utils/sql-parser.ts':183C,536C 'start':188C,610C 'statement':75B,129C,253C,311C,345C,367C,426C,525C,547C,574C 'steer':80B 'still':123C 'stop':566C 'string':264C,286C,552C,570C 'suggest':558C 'tabl':66B,100B,133C,301C,340C,389C,439C,441C 'tool':29B 'treat':54B,185C,316C,431C,516C 'true':276C,370C,410C,557C 'two':207C,228C 'unless':587C 'unmodifi':263C 'use':416C 'valid':12A,69B,251C,544C,577C 'version':534C 'via':88B 'victim':67B,302C,341C,390C 'whitespac':212C,541C,618C 'whole':285C 'without':469C 'write':96B,126C,499C","nicknames":[],"mitigations":[],"who_affected":"Teams that run DBHub with a MySQL or MariaDB database and rely on its read-only mode to limit what an AI assistant can change. PostgreSQL connectors are not affected by this path, and setups that do not use DBHub's MySQL or MariaDB connectors can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dbhub"],"ptokens":["bytebase","dbhub"],"labels":["aiagents","aitooling","cwe436","cwe863","dbhub","mariadb","mcp","medium","mysql","npm"],"first_public_at":"2026-11-02T17:57:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-j656-3hf2-fvjc","url":"https://github.com/advisories/GHSA-j656-3hf2-fvjc","severity":"medium","published_at":"2026-11-02T17:57:51+00:00","modified_at":"2026-11-02T17:57:52+00:00","first_seen_at":"2026-11-02T18:01:07+00:00","fetched_at":"2026-11-02T18:37:09+00:00","note":null}],"documents":[{"id":53203,"url":"https://api.github.com/repos/bytebase/dbhub/security-advisories/GHSA-j656-3hf2-fvjc","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":49862,"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-j656-3hf2-fvjc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":53205,"url":"https://github.com/bytebase/dbhub/pull/342","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":49860,"url":"https://github.com/bytebase/dbhub/commit/872bb338f7d31f6afe517a076ac3e3edafaaaf08","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":49861,"url":"https://github.com/bytebase/dbhub/releases/tag/v0.22.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}