CVE-2026-47252

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47252
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47252.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47252
Aliases
Downstream
Related
Published
2026-09-17T18:17:43Z
Modified
2026-09-18T03:46:49Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)
Details

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript. In plugins/chrome/tabs.go, tabsTable.Insert() passes the URL through fmt.Sprintf(newTabScript, url), and tabsTable.Update() uses fmt.Sprintf(setURLScript, pk, url). A URL containing quote and newline characters can break out of the intended string or property record and append script statements, resulting in arbitrary command execution with the privileges of the anyquery process on the macOS host. This issue is fixed in version 0.4.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47252.json"
}
References

Affected packages

Git / github.com/julien040/anyquery

Affected ranges

Type
GIT
Repo
https://github.com/julien040/anyquery
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
66d5e684cd0a1a4086758aadaf3b22aee4e6e498
Fixed
3b235b3467e6e86116677a701da9a9d8d8046557
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.4.5"
        },
        {
            "fixed": "0.2.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
v0.*
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47252.json"