CVE-2026-54629: Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

July 14, 2026

Anyquery’s server mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., csv_reader, log_reader). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system (e.g., /etc/passwd, ~/.ssh/id_rsa). This allows full Local File Read (LFR) capabilities, compromising sensitive system configurations and credentials.

References

github.com/advisories/GHSA-mf78-3rpf-r784
github.com/julien040/anyquery/releases/tag/0.4.5
github.com/julien040/anyquery/security/advisories/GHSA-mf78-3rpf-r784
nvd.nist.gov/vuln/detail/CVE-2026-54629

Code Behaviors & Features

Detect and mitigate CVE-2026-54629 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →