GitHub Advisoryadvisory · PyPI

GHSA-qhfq-gvvc-5q6q Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization

MEDIUM Published 2026-04-20 Modified 2026-04-24 Official page ↗
Aliases
CVE-2025-66335
Ecosystem
PyPI
Packages
doris-mcp-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-89
Reviewed
2026-04-24

Affected packages

• PyPI doris-mcp-server: >= 0.1.0, < 0.6.1 → fixed in 0.6.1

Description

Apache Doris MCP Server versions prior to 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Versions 0.6.1 and later are not affected.

Related

Alias · CVE (1)

  • CVE-2025-66335 Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References