CVE-2026-54629: Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

July 14, 2026

Anyquery’s server mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., csv_reader, log_reader). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system (e.g., /etc/passwd, ~/.ssh/id_rsa). This allows full Local File Read (LFR) capabilities, compromising sensitive system configurations and credentials.

References

github.com/advisories/GHSA-mf78-3rpf-r784
github.com/julien040/anyquery/releases/tag/0.4.5
github.com/julien040/anyquery/security/advisories/GHSA-mf78-3rpf-r784
nvd.nist.gov/vuln/detail/CVE-2026-54629

Code Behaviors & Features

Detect and mitigate CVE-2026-54629 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →