CVE-2026-47252 Details
Description
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript. In plugins/chrome/tabs.go, tabsTable.Insert() passes the URL through fmt.Sprintf(newTabScript, url), and tabsTable.Update() uses fmt.Sprintf(setURLScript, pk, url). A URL containing quote and newline characters can break out of the intended string or property record and append script statements, resulting in arbitrary command execution with the privileges of the anyquery process on the macOS host. This issue is fixed in version 0.4.5.
A code injection vulnerability has been identified in the Anyquery SQL query engine, specifically within the Chrome, Brave, Edge, and Safari browser plugins, prior to version 0.4.5. This vulnerability allows authenticated users with INSERT or UPDATE access to the affected macOS virtual tables to execute arbitrary operating system commands. The issue arises because the plugins interpolate SQL-controlled URLs into AppleScript or JavaScript for Automation (JXA) scripts, which are then executed via the 'osascript' command. By crafting a URL that includes newline and quote characters, it is possible to escape the intended string context and inject additional script commands, leading to command execution with the privileges of the Anyquery process on the macOS host.
Users are advised to update to Anyquery version 0.4.5 or later, where this vulnerability has been patched. The update includes changes to how URLs are handled, preventing the injection of malicious AppleScript commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/julien040/anyquery/security/advisories/GHSA-hrj8-hjv8-mgwc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/julien040/anyquery/commit/33769e03bd4b0f76d7a20a4188cce7153f6db1c9 | [email protected] | Source CodeVendor |
| https://github.com/julien040/anyquery/releases/tag/0.4.5 | [email protected] | Release NotesVendor |
| https://github.com/julien040/anyquery/security/advisories/GHSA-hrj8-hjv8-mgwc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Anyquery | <= 0.4.4 (semver) |
CPE
Remediation
| |
| Anyquery Brave | All versions |
CPE
Remediation
| |
| Anyquery Chrome | All versions |
CPE
Remediation
| |
| Anyquery Edge | All versions |
CPE
Remediation
| |
| Anyquery Reminders | All versions |
CPE
Remediation
| |
| Anyquery Safari | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |