{"action":"Upgrade @bytebase/dbhub to 0.22.6 or later.","affected":[{"fixed":"0.22.6","introduced":"0"}],"component":"@bytebase/dbhub","cve_ids":["CVE-2026-61789"],"ecosystem":"npm","epss":0.00385,"exploited":false,"fixed_versions":["0.22.6"],"ghsa_id":"GHSA-j656-3hf2-fvjc","id":"tcs_01M6F3Z1TRNT3EXX7EVWPB20EC","modified_at":"2026-11-02T18:15:06.081593729Z","published_at":"2026-11-02T17:57:51Z","references":["https://osv.dev/vulnerability/GHSA-j656-3hf2-fvjc","https://github.com/bytebase/dbhub/security/advisories/GHSA-j656-3hf2-fvjc","https://github.com/bytebase/dbhub/pull/342","https://github.com/bytebase/dbhub/commit/872bb338f7d31f6afe517a076ac3e3edafaaaf08","https://github.com/bytebase/dbhub","https://github.com/bytebase/dbhub/releases/tag/v0.22.6"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-j656-3hf2-fvjc","url":"https://osv.dev/vulnerability/GHSA-j656-3hf2-fvjc"}],"summary":"DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation"}