CVE-2026-118378
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Oct 28, 2026
CISA due date
—
The record
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. CWE-89
- CVE-2026-62849 ThingLinks is an enterprise IoT platform. CWE-89
- CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. CWE-89
- CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. CWE-89
- CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-89
- CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for… CWE-89
- CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection… CWE-89
- CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the… CWE-89