CVE-2026-54629High· 7.5▾ TwilightAnyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.0%
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can use SQLite CREATE VIRTUAL TABLE statements to provide a local path to these modules, which use hashicorp/go-getter under the Anyquery server process and return the selected file contents as queryable table rows. The disclosure is limited only by the filesystem permissions of the server process and can expose system configuration, credentials, and private keys. This issue is fixed in version 0.4.5.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/julien040/anyquery < 0.4.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-50006Critical· 9.1Anyquery is an SQL query engine built on top of SQLite
CVE-2026-54628High· 8.6Anyquery is an SQL query engine built on top of SQLite
CVE-2026-47253High· 7.3Anyquery is an SQL query engine built on top of SQLite
CVE-2026-47252Critical· 9.0Anyquery is an SQL query engine built on top of SQLite
CVE-2021-1256Medium· 6.0A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite files on the file system of an affected device by using directory traversal techniques
CVE-2025-68428High· 7.5jsPDF is a library to generate PDFs in JavaScript