• Bug: scanSingleLineComment in src/utils/sql-parser.ts starts a comment at any --. MySQL and MariaDB only do so when whitespace, a control character or end of line follows.
• Why it executes: execute-sql.ts checks each split statement with isReadOnlySQL but sends the original string, and the MySQL/MariaDB connectors open their pools with multipleStatements: true.
• Proof: the advisory shows DBHub's own parser returning one read-only statement for SELECT 1--1;DROP TABLE victim, and MariaDB 11.4 executing SELECT 1 - -1 and then dropping the table.
• Realistic attacker: anyone who can influence the SQL the agent writes, most likely via prompt injection in content the agent reads. Severity: GitHub rates it medium (CVSS 4.0 6.1, user interaction required).
• Fix: @bytebase/dbhub 0.22.6 (PR #342).

Lesson for any agent database tool: a parser-based read-only filter is not a security boundary. Give the agent a database user that only has SELECT grants (or a read replica), execute only the statements you validated, and keep multi-statement execution off.