| शीर्षक | TimBroddin astro-mcp-server 1.1.1 SQL Injection |
|---|
| विवरण | An SQL injection vulnerability (CWE-89) has been identified in astro-mcp-server version 1.1.1, specifically within src/index.ts. Multiple MCP tools, including search_rankings, accept user‑controlled parameters such as keyword, store, appName, and appId, and interpolate them directly into SQLite query strings executed by db.exec(). An attacker with network access to the MCP interface can manipulate the SQL queries to bypass filters, extract arbitrary data from the local Astro ASO database, and potentially alter query semantics. No fixed version is available at the time of reporting. |
|---|
| स्रोत | ⚠️ https://github.com/TimBroddin/astro-mcp-server/issues/2 |
|---|
| उपयोगकर्ता | _Eternity_ (UID 97332) |
|---|
| सबमिशन | 14/04/2026 04:38 PM (6 महीनों पहले) |
|---|
| संयम | 01/05/2026 11:37 AM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 360544 [TimBroddin astro-mcp-server तक 1.1.1 MCP Tool Query Construction src/index.ts request.params.arguments SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|