AIKIDO-2026-10298

TL;DR

Affected versions of this package improperly enforce a read-only guard for SQL statements using Common Table Expressions (CTEs), allowing queries such as WITH x AS (SELECT 1) DELETE FROM users to bypass validation because the regex only checks for the presence of SELECT after WITH. An attacker could exploit this weakness by crafting a malicious CTE that includes a valid SELECT in the CTE body while executing a destructive statement (e.g., DELETE, UPDATE, or INSERT) afterward, effectively performing unauthorized write operations in contexts that are expected to permit only read-only queries.