- Severity: MEDIUM
- Ecosystems: npm
- Packages: @bytebase/dbhub
The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements (for example DROP TABLE), which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent.
Root cause
The problem is a mismatch between how DBHub’s SQL parser handles single-line comments and how MySQL and MariaDB actually parse them.
In src/utils/sql-parser.ts, scanSingleLineComment treats “–” as the start of a comment no matter what character follows it. MySQL and MariaDB only begin a “–” comment when the two dashes are followed by whitespace, a control character, or the end of the line. Otherwise the dashes are read as two minus signs and the rest of the line is ordinary SQL.
The read-only check in src/tools/execute-sql.ts splits the input and validates each statement with isReadOnlySQL, but the connector then executes the original, unmodified string. The MySQL and MariaDB connectors open their connection pool with multipleStatements: true (src/connectors/mysql/index.ts:54 and src/connectors/mariadb/index.ts:53) and run the whole string in a single call.
Because of this, the following payload:
SELECT 1–1;DROP TABLE victim
is seen by DBHub as a single SELECT statement, since everything after “–” is treated as a comment and the read-only check passes. MySQL and MariaDB instead parse it as “SELECT 1 – -1” followed by “DROP TABLE victim” and execute both statements.
Pr…
Source: GitHub Security Advisories · 2026-11-02