{"cve":"CVE-2026-11529","nvd":{"published":"2026-06-08T16:16:37.650","modified":"2026-07-23T07:10:00.113","status":"Deferred","description":"A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","score":2.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cwes":["CWE-74","CWE-89"],"references":["https://github.com/designcomputer/mysql_mcp_server/commit/080bef9a96d625ce0dfbde573a08b93497871981","https://github.com/designcomputer/mysql_mcp_server/issues/89","https://github.com/designcomputer/mysql_mcp_server/pull/86","https://github.com/designcomputer/mysql_mcp_server/releases/tag/v0.3.0","https://vuldb.com/cve/CVE-2026-11529"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-11529","score":0.00205,"percentile":0.10474,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-mvq4-39wx-6h5g","url":"https://osv.dev/vulnerability/GHSA-mvq4-39wx-6h5g","summary":"MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler","modified":"2026-08-04T14:40:33.239752085Z","packages":[{"ecosystem":"PyPI","name":"mysql-mcp-server","purl":"pkg:pypi/mysql-mcp-server","ranges":["<0.3.0"],"fixed":["0.3.0"]}]},{"id":"PYSEC-2026-3579","url":"https://osv.dev/vulnerability/PYSEC-2026-3579","summary":"MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler","modified":"2026-08-04T14:30:24.510691717Z","packages":[{"ecosystem":"PyPI","name":"mysql-mcp-server","purl":"pkg:pypi/mysql-mcp-server","ranges":["<0.3.0"],"fixed":["0.3.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}