CVE-2026-31841

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31841
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31841.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-31841
Aliases
Published
2026-03-12T17:03:32.818Z
Modified
2026-07-15T01:48:52.775842919Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Raw exposure of database statements in Hyperterse MCP search tool
Details

Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing statements which were supposed to be executed under the hood, and protected from being displayed publicly. This issue has been fixed as of v2.2.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31841.json",
    "cwe_ids": [
        "CWE-433"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/hyperterse/hyperterse

Affected ranges

Type
GIT
Repo
https://github.com/hyperterse/hyperterse
Events
Introduced
6f82dd7f19c7aba7133ca19d8357ffa954cfe4a5
Fixed
884e99ac25e9c68e25a25a69548f63d64faf5ee3
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.2.0"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:hyperterse:hyperterse:*:*:*:*:*:*:*:*"
}

Affected versions

v2.*
v2.0.0
v2.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31841.json"