Log in Start free

Vulnerability · Published Oct 25, 2026 · Assigned by VulDB

CVE-2026-116053dbcli mycli Whitelist source.py source_special_command_is_safe os command injection

Medium 5.3

In plain English

A medium-severity OS command injection in mycli from dbcli. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12myclino fix listedDEBIAN-CVE-2026-116053
Debian:13myclino fix listedDEBIAN-CVE-2026-116053
Debian:14myclino fix listedDEBIAN-CVE-2026-116053

Affected products (as reported)

VendorProductVersions
dbcli mycli 2.29.02.29.12.29.22.29.32.29.42.30.02.30.1

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References