PT-2025-50556 · Neuron · Neutron

Published 2025-12-10 · Updated 2025-12-11 · CVE-2025-67510

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Neuron versions prior to 2.8.12

Description The PHP framework Neuron has an issue where the MySQLWriteTool can execute arbitrary SQL queries provided by a caller, utilizing PDO::prepare() and execute() without restrictions. This occurs because the tool is designed to write SQL, but in an AI agent context, it presents a high risk. Prompt injection or indirect prompt manipulation could lead to the execution of destructive database queries, such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements, depending on the database user's permissions. Deployments exposing an agent with the MySQLWriteTool enabled to untrusted input, or running the tool with a database user possessing broad privileges, are susceptible to this issue.

Recommendations Update to version 2.8.12 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-250

Related Identifiers

CVE-2025-67510

GHSA-898V-775G-777C

Affected Products

Neutron

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67510.json · Exploit
• https://github.com/neuron-core/neuron-ai/commit/44bab85d92bf162898ee48d0bcef6ba0d29b59c9 · Patch
• https://github.com/neuron-core/neuron-ai/security/advisories/GHSA-898v-775g-777c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67510 · Security Note
• https://github.com/neuron-core/neuron-ai/releases/tag/2.8.12 · Note
• https://github.com/neuron-core/neuron-ai/commit/ea49f8c4f35bffb56021a2ea2c9b07817fcc31b6 · Note
• https://twitter.com/CVEnew/status/1999108899182620937 · Twitter Post
• https://twitter.com/offseq/status/1998906115271397432 · Twitter Post
• https://twitter.com/CveFindCom/status/1998900265752174771 · Twitter Post
• https://t.me/CVEtracker/39423 · Telegram Post