SQL Injection Vulnerability in Tabularis SQLite Driver

CVE-2026-118378

What is CVE-2026-118378?

The Tabularis SQL injection vulnerability in versions prior to 0.28.0 allows attackers to exploit its SQLite driver. By crafting a malicious table_name when using the describe_table feature, an attacker can manipulate the PRAGMA command to execute stacked SQL statements. This could lead to unauthorized reading, modification, or deletion of SQLite database contents, circumventing normal protections like read-only access. Such exploitation poses a significant risk as it could be initiated by untrusted AI content or malicious entities.

References