CVE-2026-116053: dbcli mycli Whitelist source.py source_special_command_is_safe os command injection
A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function sourcespecialcommandissafe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The attack can be launched only on the local host, and the CVSS vector requires low privileges. Systems where local users can run affected dbcli mycli versions are therefore the relevant exposure.
What does an attacker need to exploit it?
An attacker needs local access with low privileges and must be able to manipulate input handled by the Whitelist component's source_special_command_is_safe function. No user interaction is required.
Is public exploit information available?
Yes. The available data states that an exploit has been made public and could be used in attacks.