{"items":[{"id":"NVI-00016118","kind":"vulnerability","title":"Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-mf78-3rpf-r784","CVE-2026-54629"],"plain_summary":"GitHub lists this reviewed advisory for github.com/julien040/anyquery. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4ae687ee7e1cb38e15fb0882d5fcd543"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-14T20:19:10.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-26dfe9397f6d90b946c5e98f6de83a08"},{"kind":"CVSS","as_of":"2026-09-30T17:51:56.193Z","value":"7.5 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-4ae687ee7e1cb38e15fb0882d5fcd543"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-26dfe9397f6d90b946c5e98f6de83a08","url":"https://github.com/advisories/GHSA-mf78-3rpf-r784","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mf78-3rpf-r784","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"},{"id":"sr-4ae687ee7e1cb38e15fb0882d5fcd543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54629","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-54629","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:19.229Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-26dfe9397f6d90b946c5e98f6de83a08"],"technology":"github.com/julien040/anyquery","known_exclusions":[],"conditions_summary":"## Summary\nAnyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., `csv_reader`, `log_reader`). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). This allows full Local File Read (LFR) capabilities, compromising sensitive system configurations and credentials.\n\n## Details\nAnyquery utilizes the `hashicorp/go-getter` library within its data ingestion modules. When Anyquery is launched in **Server Mode** (`anyquery server`), it binds to a TCP port and accepts MySQL protocol connections. The server handler does not restrict the usage of these virtual table modules to safe directories. An attacker can connect to the server and execute native SQLite virtual table creation queries to instantiate modules like `csv_reader` pointing to restricted files. Because the file read operation is initiated by the Anyquery server process, the attacker can read any file the process has access to.\n\n## PoC (Proof of Concept)\n1. Start the server on the victim machine:\n   ```bash\n   anyquery server --host 0.0.0.0 --","public_affected_ranges":["< 0.4.5"]}],"null_published_at":"2026-11-08T19:53:44.055Z","source_updated_at":"2026-07-14T20:19:10.000Z","source_disclosed_at":"2026-07-14T20:19:07.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-04T09:59:43.724Z"},{"id":"NVI-00016118","kind":"vulnerability","title":"Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mf78-3rpf-r784","CVE-2026-54629"],"plain_summary":"GitHub lists this reviewed advisory for github.com/julien040/anyquery. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-26dfe9397f6d90b946c5e98f6de83a08"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-14T20:19:10.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-26dfe9397f6d90b946c5e98f6de83a08"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-26dfe9397f6d90b946c5e98f6de83a08","url":"https://github.com/advisories/GHSA-mf78-3rpf-r784","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mf78-3rpf-r784","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-26dfe9397f6d90b946c5e98f6de83a08"],"technology":"github.com/julien040/anyquery","known_exclusions":[],"conditions_summary":"## Summary\nAnyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., `csv_reader`, `log_reader`). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). This allows full Local File Read (LFR) capabilities, compromising sensitive system configurations and credentials.\n\n## Details\nAnyquery utilizes the `hashicorp/go-getter` library within its data ingestion modules. When Anyquery is launched in **Server Mode** (`anyquery server`), it binds to a TCP port and accepts MySQL protocol connections. The server handler does not restrict the usage of these virtual table modules to safe directories. An attacker can connect to the server and execute native SQLite virtual table creation queries to instantiate modules like `csv_reader` pointing to restricted files. Because the file read operation is initiated by the Anyquery server process, the attacker can read any file the process has access to.\n\n## PoC (Proof of Concept)\n1. Start the server on the victim machine:\n   ```bash\n   anyquery server --host 0.0.0.0 --","public_affected_ranges":["< 0.4.5"]}],"null_published_at":"2026-11-04T10:04:27.895Z","source_updated_at":"2026-07-14T20:19:10.000Z","source_disclosed_at":"2026-07-14T20:19:07.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T09:59:43.724Z"}],"next_cursor":null,"snapshot_revision":"42594"}