CVE-2026-47252Critical· 9.0▾ AbyssalPoC availableAnyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brav…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 49.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.4%
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript. In plugins/chrome/tabs.go, tabsTable.Insert() passes the URL through fmt.Sprintf(newTabScript, url), and tabsTable.Update() uses fmt.Sprintf(setURLScript, pk, url). A URL containing quote and newline characters can break out of the intended string or property record and append script statements, resulting in arbitrary command execution with the privileges of the anyquery process on the macOS host. This issue is fixed in version 0.4.5.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/julien040/anyquery/plugins/chrome < 0.0.0-20240826075852-c651df0b8767github.com/julien040/anyquery/plugins/brave < 0.0.0-20240826075852-c651df0b8767github.com/julien040/anyquery/plugins/edge < 0.0.0-20240826075852-c651df0b8767github.com/julien040/anyquery/plugins/safari < 0.0.0-20240826075852-c651df0b8767Patched in:
github.com/julien040/anyquery/plugins/chrome 0.0.0-20240826075852-c651df0b8767github.com/julien040/anyquery/plugins/brave 0.0.0-20240826075852-c651df0b8767github.com/julien040/anyquery/plugins/edge 0.0.0-20240826075852-c651df0b8767github.com/julien040/anyquery/plugins/safari 0.0.0-20240826075852-c651df0b8767Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54628High· 8.6Anyquery is an SQL query engine built on top of SQLite
CVE-2026-50006Critical· 9.1Anyquery is an SQL query engine built on top of SQLite
CVE-2026-47253High· 7.3Anyquery is an SQL query engine built on top of SQLite
CVE-2026-54629High· 7.5Anyquery is an SQL query engine built on top of SQLite
CVE-2025-14576High· 7.8Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick
CVE-2023-3519Critical· 9.8Unauthenticated remote code execution