{"cve":"CVE-2025-66335","nvd":{"published":"2026-04-20T14:16:16.760","modified":"2026-10-07T09:10:00.160","status":"Analyzed","description":"Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-89"],"references":["https://lists.apache.org/thread/odp0fyyst8kxm7hhm9z4d1snh1y4hjpy","http://www.openwall.com/lists/oss-security/2026/04/17/4"],"products":["apache:doris_mcp_server"],"source":"nvd","synced_at":"2026-10-19T22:30:49.762551342+00:00"},"epss":{"cve":"CVE-2025-66335","score":0.00655,"percentile":0.51087,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-qhfq-gvvc-5q6q","url":"https://osv.dev/vulnerability/GHSA-qhfq-gvvc-5q6q","summary":"Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization","modified":"2026-07-13T16:43:43.157683274Z","packages":[{"ecosystem":"PyPI","name":"doris-mcp-server","purl":"pkg:pypi/doris-mcp-server","ranges":[">=0.1.0 <0.6.1"],"fixed":["0.6.1"]}]},{"id":"PYSEC-2026-2459","url":"https://osv.dev/vulnerability/PYSEC-2026-2459","summary":"Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization","modified":"2026-07-13T16:31:44.828022744Z","packages":[{"ecosystem":"PyPI","name":"doris-mcp-server","purl":"pkg:pypi/doris-mcp-server","ranges":[">=0.1.0 <0.6.1"],"fixed":["0.6.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}