GHSA-92gp-jfgx-9qpv

Source

https://github.com/advisories/GHSA-92gp-jfgx-9qpv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-92gp-jfgx-9qpv/GHSA-92gp-jfgx-9qpv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-92gp-jfgx-9qpv

Aliases

CVE-2026-31841

Published

2026-03-12T18:32:54Z

Modified

2026-03-14T05:56:20Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Hyperterse: Raw exposure of database statements in MCP search tool

Details

Hyperterse allows users to specify database queries for tools to execute under the hood. As of v2.0.0, there are only two tools exposed - search and execute.

The search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing statements which were supposed to be executed under the hood, and protected from being displayed publicly.

This issue has been fixed as of v2.2.0 and relevant tests to catch these have been added.

Database specific

{
    "cwe_ids":  [
        "CWE-433"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-12T18:32:54Z",
    "nvd_published_at":  "2026-03-12T17:16:51Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / hyperterse

Package

Name: hyperterse; View open source insights on deps.dev
Purl: pkg:npm/hyperterse

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-92gp-jfgx-9qpv/GHSA-92gp-jfgx-9qpv.json"