---
title: DBHub MCP database server: 'SELECT 1--1;DROP TABLE victim' slips past read-only mode on MySQL and MariaDB, so a prompt-injected agent can write and drop tables; fixed in 0.22.6 | ctxsec
url: https://ctxsec.com/items/dbhub-mcp-read-only-bypass-mysql-comment-ghsa-j656
description: "DBHub (@bytebase/dbhub), an MCP server that gives AI agents SQL access, has a read-only mode meant to stop agents from changing data. Its SQL parser treats '--' as a comment even when no space follows, but MySQL and MariaDB read '--1' as two minus signs. Because DBHub validates the split statements but then runs the original string with multipleStatements enabled, a payload like SELECT 1--1;DROP TABLE victim passes the check and executes both statements. PostgreSQL is not affected. Update to 0.22.6."
status: "official (GitHub-reviewed advisory GHSA-j656-3hf2-fvjc and bytebase/dbhub v0.22.6 fix, Nov 2); no CVE yet"
published: 2026-11-02
---

> DBHub (@bytebase/dbhub), an MCP server that gives AI agents SQL access, has a read-only mode meant to stop agents from changing data. Its SQL parser treats '--' as a comment even when no space follows, but MySQL and MariaDB read '--1' as two minus signs. Because DBHub validates the split statements but then runs the original string with multipleStatements enabled, a payload like SELECT 1--1;DROP TABLE victim passes the check and executes both statements. PostgreSQL is not affected. Update to 0.22.6.

[← Context & Harness Attacks](/context) · [markdown](/items/dbhub-mcp-read-only-bypass-mysql-comment-ghsa-j656.md)

official (GitHub-reviewed advisory GHSA-j656-3hf2-fvjc and bytebase/dbhub v0.22.6 fix, Nov 2); no CVE yet

2026-11-02

### DBHub MCP database server: 'SELECT 1--1;DROP TABLE victim' slips past read-only mode on MySQL and MariaDB, so a prompt-injected agent can write and drop tables; fixed in 0.22.6

- **Bug:** `scanSingleLineComment` in `src/utils/sql-parser.ts` starts a comment at any `--`. MySQL and MariaDB only do so when whitespace, a control character or end of line follows.
- **Why it executes:** `execute-sql.ts` checks each split statement with `isReadOnlySQL` but sends the original string, and the MySQL/MariaDB connectors open their pools with `multipleStatements: true`.
- **Proof:** the advisory shows DBHub's own parser returning one read-only statement for `SELECT 1--1;DROP TABLE victim`, and MariaDB 11.4 executing `SELECT 1 - -1` and then dropping the table.
- **Realistic attacker:** anyone who can influence the SQL the agent writes, most likely via prompt injection in content the agent reads. Severity: GitHub rates it medium (CVSS 4.0 6.1, user interaction required).
- **Fix:** `@bytebase/dbhub` **0.22.6** (PR #342).

**Lesson for any agent database tool:** a parser-based read-only filter is not a security boundary. Give the agent a database user that only has SELECT grants (or a read replica), execute only the statements you validated, and keep multi-statement execution off.

Sources: [GitHub advisory GHSA-j656-3hf2-fvjc (Nov 2)](https://github.com/advisories/GHSA-j656-3hf2-fvjc) · [bytebase/dbhub security advisory](https://github.com/bytebase/dbhub/security/advisories/GHSA-j656-3hf2-fvjc) · [Fix PR #342](https://github.com/bytebase/dbhub/pull/342) · [dbhub v0.22.6 release](https://github.com/bytebase/dbhub/releases/tag/v0.22.6)