PT-2026-35575 · Unknown · Sqlite-Mcp

Smallw · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7206

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dubydu sqlite-mcp versions prior to 0.1.1

Description A flaw in the extract to json() function within the src/entry.py file allows for remote SQL injection. This occurs when the output filename argument is manipulated, enabling an attacker to execute unauthorized SQL commands.

Recommendations Apply patch a5580cb992f4f6c308c9ffe6442b2e76709db548. As a temporary workaround, restrict or avoid the use of the output filename argument in the extract to json() function.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-7206

GHSA-4J28-22QP-RJCF

Affected Products

Sqlite-Mcp

References · 12

• 🔥 https://github.com/dubydu/sqlite-mcp/issues/1 · Exploit
• https://github.com/dubydu/sqlite-mcp/commit/a5580cb992f4f6c308c9ffe6442b2e76709db548 · Patch
• https://github.com/dubydu/sqlite-mcp/pull/2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7206 · Security Note
• https://osv.dev/vulnerability/GHSA-4j28-22qp-rjcf · Vendor Advisory
• https://vuldb.com/vuln/359806/cti · Note
• https://vuldb.com/submit/802081 · Note
• https://twitter.com/CVEarity/status/2049085704857358725 · Twitter Post
• https://vuldb.com/vuln/359806 · Note
• https://github.com/dubydu/sqlite-mcp · Note
• https://t.me/CVEtracker/52019 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2049024445667299776 · Twitter Post