CVE-2026-118378: Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Tabularis installations using a version before 0.28.0 are affected where MCP clients can invoke the SQLite describe_table tool. The vulnerable path is specifically the SQLite driver.
What does an attacker need to exploit this issue?
An attacker needs to cause an MCP client to submit a crafted table_name value to describe_table. This can include an AI agent that has been influenced by untrusted content; no prior privileges are required, but user interaction is required.
Can read-only mode or write approval prevent exploitation?
No. The issue allows stacked SQL statements that can bypass both read-only mode and write approval, permitting SQLite data to be read, modified, or dropped.
How can I determine whether I am affected?
Check whether Tabularis is earlier than 0.28.0 and whether it uses the SQLite driver with MCP clients able to call describe_table. If both conditions apply, treat the deployment as affected.