PRIMARY-SOURCE REVIEW · 2026-11-03T16:20:00+09:00

DBHub: MySQL/MariaDB read-only bypass fixed in 0.22.6

In @bytebase/dbhub below 0.22.6, different SQL comment interpretation can bypass the MySQL/MariaDB connector read-only check. An actor able to influence SQL sent by an AI can reach writes or DDL when database permissions allow them. PostgreSQL is outside this path.

What to check

Update to 0.22.6 or later and also restrict the database account to read-only access. Check AI inputs, connection privileges and audit logs. Updating does not establish that earlier writes never occurred.

A first fixed version is listed only when the advisory provides one. Advisory counts are not incident counts.

Affected and fixed versions by advisory (1)

GHSA-j656-3hf2-fvjc

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

  • @bytebase/dbhub (npm): affected < 0.22.6 → fixed 0.22.6

Primary sources

GHSA-j656-3hf2-fvjc

Related topics

SD-JWT: silently discarded disclosures can change authorization · npm: 92 malicious-package advisories; check affected releases · PyPI: 2 malicious-package advisories; check affected releases · RubyGems: 3 malicious-package advisories; check affected releases