CVE-2026-118378 in Tabularis
Summary
by MITRE • 10/28/2026
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Tabularis prior to version 0.28.0 represents a critical security flaw within its interaction with SQLite databases through the Model Context Protocol. This issue specifically affects the describe_table tool, which is designed to provide metadata about database tables. The core of the problem lies in how the application handles input validation for the table_name parameter passed by MCP clients. Instead of strictly validating or sanitizing this input against a whitelist of known safe identifiers, the system constructs SQL queries using string concatenation without adequate protection against injection attacks. This architectural oversight allows an attacker to manipulate the intended query structure by injecting malicious SQL syntax directly into the table name field.
From a technical perspective, the flaw enables stacked statement execution within SQLite. By carefully crafting the input for the table_name argument, an adversary can close the existing quoted string used in the PRAGMA command and append additional SQL statements. This technique bypasses the intended scope of the describe_table function, which is merely to retrieve schema information. Once the attacker closes the initial query context, they can inject commands that perform data retrieval, modification, or deletion operations. Because SQLite supports multiple statements separated by semicolons in many execution contexts, this injection vector effectively transforms a read-only metadata request into a powerful administrative command interface.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and data compromise. The ability to execute stacked statements allows attackers to bypass the database's read-only mode restrictions that might otherwise limit write operations. Furthermore, it circumvents any application-level write approval mechanisms designed to prevent unauthorized modifications. An attacker who gains access to an MCP client can leverage this flaw not only as a direct SQL injection attack but also through indirect means such as AI agents steered by untrusted content. In scenarios where large language models or automated agents process external data and subsequently query the database, maliciously crafted inputs embedded in that data could trigger this vulnerability automatically, leading to silent data exfiltration or destructive schema alterations without user intervention.
This incident aligns with CWE-89, which classifies improper neutralization of special elements used in an SQL command, commonly known as SQL injection. The specific mechanism of appending additional commands after closing a string context is characteristic of stacked query attacks. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques related to Data Injection and potentially Command and Control if exploited within automated agent workflows. It highlights the risks associated with integrating AI-driven systems directly into database operations without rigorous input validation layers.
To mitigate this risk, immediate updates to Tabularis version 0.28.0 or later are required as these versions address the underlying SQL construction logic. For environments where upgrading is not immediately feasible, implementing strict allow-listing for table names is essential. The application should validate that any provided table_name exists in a predefined list of safe identifiers before constructing queries. Additionally, employing parameterized queries or prepared statements wherever possible can prevent string concatenation vulnerabilities from being exploited. It is also advisable to enforce least-privilege database accounts so that even if an injection occurs, the compromised account lacks permissions for DROP TABLE or other destructive operations. Regular security audits focusing on dynamic SQL generation in AI-integrated applications are recommended to detect similar patterns early.