CVE-2026-11529
6.3 MEDIUMA vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2
Published: 2026-06-08 · Last updated: 2026-06-09
Severity and scoring
- CVSS
- 6.3 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CWE
- CWE-74, CWE-89
Description
A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-11529
- [Other]https://github.com/designcomputer/mysql_mcp_server/commit/080bef9a96d625ce0dfbde573a08b93497871981
- [Other]https://github.com/designcomputer/mysql_mcp_server/issues/89
- [Other]https://github.com/designcomputer/mysql_mcp_server/pull/86
- [Other]https://github.com/designcomputer/mysql_mcp_server/releases/tag/v0.3.0
- [Other]https://vuldb.com/cve/CVE-2026-11529
- [Other]https://vuldb.com/submit/836490
- [Other]https://vuldb.com/vuln/369146
- [Other]https://vuldb.com/vuln/369146/cti
Related CVEs
Same CWE
- CVE-2026-53474 — A flaw was found in migration-planner (9.6 CRITICAL)
- CVE-2026-52758 — Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL qu... (8.8 HIGH)
- CVE-2026-49498 — Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to e... (8.8 HIGH)
- CVE-2026-11859 — An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation...
- CVE-2026-3018 — The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up t... (7.5 HIGH)