AIKIDO-2025-10852

TL;DR

Affected versions of this package are vulnerable to SQL injection. To mitigate unsafe SQL execution, additional restrictions were added to block dangerous statements. MySQLSelectTool now forbids the use of INTO, OUTFILE, DUMPFILE, and LOAD_FILE, preventing attackers from writing files or reading arbitrary server files. Similarly, MySQLWriteTool was updated to disallow high-risk statements such as DROP, CREATE, ALTER, GRANT, TRUNCATE, REPLACE, MERGE, CALL, EXECUTE, and DELETE, reducing the risk of destructive or privilege-escalating SQL operations when user-controlled input is present.