GHSA-J656-3HF2-FVJC: GHSA-j656-3hf2-fvjc: Read-Only SQL Validation Bypass via Comment Interpretation Conflict in Bytebase DBHub

#security #cve #cybersecurity #ghsa

GHSA-j656-3hf2-fvjc: Read-Only SQL Validation Bypass via Comment Interpretation Conflict in Bytebase DBHub

Vulnerability ID: GHSA-J656-3HF2-FVJC
CVSS Score: 6.1
Published: 2026-11-02

An interpretation conflict in Bytebase DBHub (< 0.22.6) allows attackers to bypass read-only SQL query restrictions when connected to MySQL or MariaDB instances. Because DBHub's custom SQL tokenizer treats any '--' sequence as a comment, whereas MySQL and MariaDB require trailing whitespace or a control character, crafted queries containing '--' immediately followed by non-whitespace characters allow stacked destructive SQL statements to execute on connections configured as read-only.

TL;DR

DBHub versions prior to 0.22.6 fail to enforce MySQL and MariaDB whitespace requirements for single-line '--' comments in the read-only SQL validator. Attackers or compromised AI agents can append stacked DDL or DML statements after a non-whitespace '--' sequence (e.g., 'SELECT 1--1;DROP TABLE victim') to execute unauthorized database modifications.

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: GHSA-j656-3hf2-fvjc
Affected Package: @bytebase/dbhub (< 0.22.6)
Primary CWE: CWE-436 (Interpretation Conflict)
Secondary CWE: CWE-863 (Incorrect Authorization)
CVSS v4 Score: 6.1 (Medium)
Attack Vector: Network (SQL Query / Prompt Injection)
Impact: Read-Only Bypass (Arbitrary DDL/DML Execution)
Exploit Status: Proof-of-Concept Documented

Affected Systems

@bytebase/dbhub (npm package)
@bytebase/dbhub: < 0.22.6 (Fixed in: 0.22.6)

Code Analysis

Commit: 872bb33

Implement MySQL/MariaDB specific single-line comment scanning and enforce START TRANSACTION READ ONLY in connectors.

Exploit Details

GitHub Security Advisory: Official advisory containing proof-of-concept SQL payload demonstrating the read-only validation bypass.

Mitigation Strategies

Upgrade @bytebase/dbhub to version 0.22.6 or later to apply dialect-specific comment tokenization and read-only transaction wrappers.
Enforce principle of least privilege at the database layer by configuring DBHub connections with a MySQL/MariaDB user restricted strictly to SELECT privileges.
Monitor and filter incoming SQL queries at the proxy or application layer for '--' sequences not followed by whitespace that precede semicolons.

Remediation Steps:

Update package.json or global npm/npx installations to require @bytebase/dbhub >= 0.22.6.
Audit existing MySQL and MariaDB user accounts utilized by DBHub and revoke write/DDL permissions (DROP, DELETE, UPDATE, INSERT, ALTER) if the connection is intended to be read-only.
Review database general query logs or audit logs for stacked queries matching the pattern '--[^\s\x00-\x20\x7F].*;'.

References

Read the full report for GHSA-J656-3HF2-FVJC on our website for more details including interactive diagrams and full exploit analysis.

DEV Community