- Latest release
- v0.1.6 (Jan 16, 2025): affected by 4 advisories
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 4 · 1 critical, 3 high
- Releases
- 6 since v0.1.1 (Aug 6, 2024)
- Registry
- pkg.go.dev
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-54628Affects v0.1.1 to v0.1.6 (through the newest release)
- CVE-2026-50006Affects v0.1.1 to v0.1.6 (through the newest release)
- CVE-2026-54629Affects v0.1.1 to v0.1.6 (through the newest release)
- CVE-2026-47253Affects v0.1.1 to v0.1.6 (through the newest release)
Advisories 4
- CVE-2026-54628High 8.6
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
Affected: all versions.
No fix released. The latest release, v0.1.6, is still affected.
- CVE-2026-50006Critical 9.1
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Affected: all versions.
No fix released. The latest release, v0.1.6, is still affected.
- CVE-2026-54629High 7.5
Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
Affected: all versions.
No fix released. The latest release, v0.1.6, is still affected.
- CVE-2026-47253High 7.3
Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion
Affected: all versions; fixed in 0.4.5.
No fix released. The latest release, v0.1.6, is still affected.