Tabularis: SQL injection in SQLite driver via MCP describe_table
Summary
Tabularis is a desktop SQL client with a built-in MCP server that lets AI assistants read schemas and run queries. In versions before 0.28.0, the SQLite driver inserts the table_name argument of the describe_table MCP tool into a query string, so crafted input can close the quoted PRAGMA argument and append further SQL statements. An attacker, including an AI agent steered by untrusted content, could read, modify or drop SQLite data and bypass read-only mode and write approval.
Affected
- Tabularis before 0.28.0
- Lowest affected version: Unknown.
- Third-party sources differ on the lower bound (for example 0.10.0).
Fixed in
- Fixed in Tabularis 0.28.0 (vendor release). The project lists v0.29.0 as newer.
Workaround
- No vendor-published workaround. The vendor's remedy is the upgrade.
- Until the upgrade is done, stop the MCP server on machines with sensitive SQLite files (it can be started via tabularis --mcp or the Settings menu).
- Do not let AI agents process untrusted content while the MCP server is connected.
Exploitation
- Exploited in the wild: Not known.
- Public proof-of-concept: none found in the sources reviewed.
- CISA KEV: not verified directly.
Our recommendation
- Upgrade Tabularis to 0.28.0 or later (latest release recommended).
- Identify installations and check whether the MCP server is enabled, especially where AI agents are used.
- Disable the MCP server or restrict AI agent use on machines with sensitive SQLite data until patched.
- Treat AI agent output and untrusted content as untrusted input when working with databases.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-xrx3-j98v-67x9 github.com
- Fix commit fd1bdbb github.com
- Tabularis release v0.28.0 github.com
- VulnCheck advisory www.vulncheck.com
- Vulnerable code (sqlite/mod.rs) github.com
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:56.
Original description (NVD)
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
NVD references (6)
- https://github.com/TabularisDB/tabularis
- https://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/drivers/…
- https://github.com/TabularisDB/tabularis/commit/fd1bdbbae35e5367c32d1e7fe9c44cb1b6875d74
- https://github.com/TabularisDB/tabularis/releases/tag/v0.28.0
- https://github.com/TabularisDB/tabularis/security/advisories/GHSA-xrx3-j98v-67x9
- https://www.vulncheck.com/advisories/tabularis-before-0.28.0-sql-injection-via-mcp-describe-table-table-name
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.