Log in Start free

Vulnerability · Published Apr 28, 2026 · Assigned by VulDB

CVE-2026-7206dubydu sqlite-mcp entry.py extract_to_json sql injection

High 7.3

In plain English

A high-severity SQL injection in sqlite-mcp from dubydu. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/entry.py. Performing a manipulation of the argument output_filename results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named a5580cb992f4f6c308c9ffe6442b2e76709db548. Applying a patch is the recommended action to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIsqlite-mcpno fix listedGHSA-4j28-22qp-rjcf
PyPIsqlite-mcpno fix listedPYSEC-2026-3074

Affected products (as reported)

VendorProductVersions
dubydu sqlite-mcp 0.1.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References