SZB-d1e9a6f17a
DBHub read-only SQL validation bypass on MySQL and MariaDB (EUVD-2026-114181)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- bytebase
- Product
- DBHub
- First seen
Summary
The EUVD listing, scored 6.1 under CVSS v3.1, says read-only SQL validation in DBHub versions before 0.22.6 can be bypassed on the MySQL and MariaDB connectors. The listing attributes the parsing issue to the single-line comment scanning in sql-parser.ts.
If you use bytebase
Upgrade DBHub to version 0.22.6 or later
Do not rely on DBHub read-only mode as the only control
Limit database user privileges for DBHub connections
What the sources say 1
· Mastodon: “Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors.” Source