CVE-2026-116053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116053", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-10-24T21:23:53.601Z", "datePublished": "2026-10-25T13:30:09.456Z", "dateUpdated": "2026-10-26T16:40:46.983Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-25T13:30:09.456Z"}, "title": "dbcli mycli Whitelist source.py source_special_command_is_safe os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "dbcli", "product": "mycli", "versions": [{"version": "2.29.0", "status": "affected"}, {"version": "2.29.1", "status": "affected"}, {"version": "2.29.2", "status": "affected"}, {"version": "2.29.3", "status": "affected"}, {"version": "2.29.4", "status": "affected"}, {"version": "2.30.0", "status": "affected"}, {"version": "2.30.1", "status": "affected"}], "cpes": ["cpe:2.3:a:dbcli:mycli:*:*:*:*:*:*:*:*"], "modules": ["Whitelist"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-10-24T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-10-24T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-24T23:29:25.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/426137", "name": "VDB-426137 | dbcli mycli Whitelist source.py source_special_command_is_safe os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/426137/cti", "name": "VDB-426137 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-116053", "name": "CVE-2026-116053 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/995818", "name": "Submit #995818 | dbcli mycli v2.25.3/ main @ b57e676 (as of 2026-09-23) mycli/packages/special/source.py whitelist asymmetry \u2192 persisten", "tags": ["third-party-advisory"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-26T15:38:30.381402Z", "id": "CVE-2026-116053", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T16:40:46.983Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116053", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T15:38:30.381402Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T15:38:31.560Z"}}], "cna": {"title": "dbcli mycli Whitelist source.py source_special_command_is_safe os command injection", "credits": [{"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:dbcli:mycli:*:*:*:*:*:*:*:*"], "vendor": "dbcli", "modules": ["Whitelist"], "product": "mycli", "versions": [{"status": "affected", "version": "2.29.0"}, {"status": "affected", "version": "2.29.1"}, {"status": "affected", "version": "2.29.2"}, {"status": "affected", "version": "2.29.3"}, {"status": "affected", "version": "2.29.4"}, {"status": "affected", "version": "2.30.0"}, {"status": "affected", "version": "2.30.1"}]}], "timeline": [{"lang": "en", "time": "2026-10-24T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-10-24T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-24T23:29:25.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/426137", "name": "VDB-426137 | dbcli mycli Whitelist source.py source_special_command_is_safe os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/426137/cti", "name": "VDB-426137 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-116053", "name": "CVE-2026-116053 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/995818", "name": "Submit #995818 | dbcli mycli v2.25.3/ main @ b57e676 (as of 2026-09-23) mycli/packages/special/source.py whitelist asymmetry \u2192 persisten", "tags": ["third-party-advisory"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-25T13:30:09.456Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116053", "state": "PUBLISHED", "dateUpdated": "2026-10-26T16:40:46.983Z", "dateReserved": "2026-10-24T21:23:53.601Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-10-25T13:30:09.456Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:dbcli:mycli:*:*:*:*:*:*:*:*"], "modules": ["Whitelist"], "product": "mycli", "vendor": "dbcli", "versions": [{"status": "affected", "version": "2.29.0"}, {"status": "affected", "version": "2.29.1"}, {"status": "affected", "version": "2.29.2"}, {"status": "affected", "version": "2.29.3"}, {"status": "affected", "version": "2.29.4"}, {"status": "affected", "version": "2.30.0"}, {"status": "affected", "version": "2.30.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-116053", "lastModified": "2026-10-26T17:17:19.200", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116053", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T15:38:30.381402Z", "version": "2.0.3"}}]}, "published": "2026-10-25T14:16:50.903", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-116053"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/995818"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/426137"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/426137/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mycli: mycli: Operating system command injection via special command validation bypass", "id": "2560460", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560460"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-78", "details": ["A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "A flaw was found in mycli. A local attacker can execute arbitrary operating system commands by supplying crafted input that bypasses safety checks in the special command whitelist. This allows malicious commands to run with the permissions of the user running the application."], "mitigation": {"lang": "en:us", "value": "Avoid processing untrusted special-command/source inputs in mycli until an upstream fix is available. No fixed release has been published upstream (the latest PyPI release, 2.30.1, is the top of the affected range), so there is currently no upgrade path that remediates this flaw."}, "name": "CVE-2026-116053", "public_date": "2026-10-25T13:30:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116053\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116053\nhttps://vuldb.com/cve/CVE-2026-116053\nhttps://vuldb.com/submit/995818\nhttps://vuldb.com/vuln/426137\nhttps://vuldb.com/vuln/426137/cti"], "statement": "A local user of mycli can execute arbitrary operating system commands by supplying crafted input that bypasses the safety checks of the special command whitelist (source_special_command_is_safe in mycli/packages/special/source.py). This is a local OS command injection in a terminal database client; the injected commands execute with the privileges of the user running mycli.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.29.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.29.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.29.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.29.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.29.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.30.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.30.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "mycli", "source": "cna", "vendor": "dbcli"}, "product": "mycli", "vendor": "dbcli"}], "created": "2026-10-25T16:30:16.824232+00:00", "updated": "2026-10-25T16:45:14.456956+00:00", "vendors": ["dbcli", "dbcli$PRODUCT$mycli"]}