Log in Start free

Vulnerability · Published Jun 8, 2026 · Assigned by VulDB

CVE-2026-11529designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in mysql-mcp-server from designcomputer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 89.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPImysql-mcp-server0.3.0GHSA-mvq4-39wx-6h5g
PyPImysql-mcp-server0.3.0PYSEC-2026-3579

Affected products (as reported)

VendorProductVersions
designcomputer mysql-mcp-server 0.2.00.2.10.2.2

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References