{"cve":"CVE-2025-59333","nvd":{"published":"2025-09-16T15:15:46.450","modified":"2026-06-17T09:45:55.497","status":"Analyzed","description":"The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a \"read-only\" mode. This vulnerability affects only the npm distribution; other distributions are not impacted. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and potentially others that expose elevated functionalities. These attacks may lead to denial of service and other unexpected behaviors.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","score":8.1},"cwes":["CWE-284"],"references":["https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw","https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw"],"products":["executeautomation:mcp_database_server"],"source":"nvd","synced_at":"2026-10-19T22:10:08.713834912+00:00"},"epss":{"cve":"CVE-2025-59333","score":0.00398,"percentile":0.34021,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-65hm-pwj5-73pw","url":"https://osv.dev/vulnerability/GHSA-65hm-pwj5-73pw","summary":"@executeautomation/database-server does not properly restrict access, bypassing a \"read-only\" mode","modified":"2025-09-16T20:42:27.321464Z","packages":[{"ecosystem":"npm","name":"@executeautomation/database-server","purl":"pkg:npm/%40executeautomation/database-server","ranges":["<=1.1.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}