CVE-2026-50006
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Anyquery prior to 0.4.5 forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.
Risk Assessment
An attacker can create or overwrite arbitrary files writable by the server process, leading to data integrity loss and denial of service, and in some cases code execution.
Recommendation
Update Anyquery to version 0.4.5 or later and restrict the server process's write permissions and network access to the MySQL port.
Other vulnerabilities in Anyquery
See all- CVE-2026-47252Critical
Anyquery prior to 0.4.5 allows authenticated users with INSERT or UPDATE access to macOS virtual tables to execute operating-system commands. The Chrome, Brave, Edge, and Safari plugins interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript.
- CVE-2026-54629High
Anyquery before 0.4.5 exposes file-backed SQLite virtual table modules (csv_reader, log_reader) through its MySQL-compatible server port without authentication, allowing a remote attacker to read arbitrary files from the system.
- CVE-2026-54628High
Anyquery prior to 0.4.5 exposes URL-capable SQLite virtual table modules (json_reader, log_reader) through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can supply a loopback, private-network, or link-local URL (e.g. cloud metadata), causing go-getter to fetch the resource and expose the response as queryable table data.
- CVE-2026-47253High
In Anyquery prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke it via the /v1/query HTTP endpoint, causing recursive deletion of any directory writable by the Anyquery server process.
Original NVD description (English source)
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS