{"items":[{"id":"NVI-00013057","kind":"vulnerability","title":"@bytebase/dbhub's read-only mode does not prevent database writes","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-mwwr-p57h-56pf","CVE-2026-61788"],"plain_summary":"GitHub lists this reviewed advisory for @bytebase/dbhub. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7a1b78bdbdbfc4ef6a5fbfff00e02a6e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-24T19:38:02.000Z","value":"7.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4c9a6e6af8c2343d38e697e97aee5c16"},{"kind":"CVSS","as_of":"2026-09-30T19:57:08.043Z","value":"7.4 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-7a1b78bdbdbfc4ef6a5fbfff00e02a6e"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4c9a6e6af8c2343d38e697e97aee5c16","url":"https://github.com/advisories/GHSA-mwwr-p57h-56pf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mwwr-p57h-56pf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"},{"id":"sr-7a1b78bdbdbfc4ef6a5fbfff00e02a6e","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61788","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-61788","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-04T02:47:38.696Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4c9a6e6af8c2343d38e697e97aee5c16"],"technology":"@bytebase/dbhub","known_exclusions":[],"conditions_summary":"### Summary\n \nSetting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`.\n \n### Details\n \nTwo problems combine.\n \n**1. The database-level read-only control is dead code.**\n \n`PostgresConnector.connect()` only enables it when `config.readonly` is truthy (`src/connectors/postgres/index.ts:175-177`):\n \n```ts\n// SDK-level readonly enforcement: Set default_transaction_read_only for the entire connection\ni","public_affected_ranges":["< 0.22.6"]}],"null_published_at":"2026-11-08T15:11:49.360Z","source_updated_at":"2026-09-24T19:38:02.000Z","source_disclosed_at":"2026-09-24T19:37:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T07:24:52.155Z"},{"id":"NVI-00013057","kind":"vulnerability","title":"@bytebase/dbhub's read-only mode does not prevent database writes","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mwwr-p57h-56pf","CVE-2026-61788"],"plain_summary":"GitHub lists this reviewed advisory for @bytebase/dbhub. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4c9a6e6af8c2343d38e697e97aee5c16"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-24T19:38:02.000Z","value":"7.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4c9a6e6af8c2343d38e697e97aee5c16"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4c9a6e6af8c2343d38e697e97aee5c16","url":"https://github.com/advisories/GHSA-mwwr-p57h-56pf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mwwr-p57h-56pf","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4c9a6e6af8c2343d38e697e97aee5c16"],"technology":"@bytebase/dbhub","known_exclusions":[],"conditions_summary":"### Summary\n \nSetting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`.\n \n### Details\n \nTwo problems combine.\n \n**1. The database-level read-only control is dead code.**\n \n`PostgresConnector.connect()` only enables it when `config.readonly` is truthy (`src/connectors/postgres/index.ts:175-177`):\n \n```ts\n// SDK-level readonly enforcement: Set default_transaction_read_only for the entire connection\ni","public_affected_ranges":["< 0.22.6"]}],"null_published_at":"2026-11-01T07:29:12.913Z","source_updated_at":"2026-09-24T19:38:02.000Z","source_disclosed_at":"2026-09-24T19:37:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:24:52.155Z"}],"next_cursor":null,"snapshot_revision":"42594"}