CVE-2026-4593: erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injection

Published Mar 23, 2026

Updated

A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the file erupt-ai/src/main/java/xyz/erupt/ai/call/impl/EruptDataQuery.java of the component MCP Tool Interface. This manipulation causes sql injection hibernate. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

erupts erupt bis=1.13.3

Event History

Mar 23, 2026

CVE Published

via MITRE·04:55 PM

Data Sourced

via MITRE·04:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Apr 7, 58249

Event

via FIRST·05:55 PM

Frequently Asked Questions

What is the severity of CVE-2026-4593?

CVE-2026-4593 is classified as a high-severity vulnerability due to its potential for SQL injection.

How do I fix CVE-2026-4593?

To fix CVE-2026-4593, upgrade the affected software to the latest version that addresses this vulnerability.

What component is affected by CVE-2026-4593?

CVE-2026-4593 affects the EruptDataQuery function in the MCP Tool Interface of erupts erupt bis version 1.13.3.

What type of vulnerability is CVE-2026-4593?

CVE-2026-4593 is a SQL injection vulnerability that allows attackers to manipulate database queries.

What software versions are vulnerable to CVE-2026-4593?

The only affected software version for CVE-2026-4593 is erupts erupt bis version 1.13.3.