CVE-2026-31841: Hyperterse Database Statement Exposure in MCP Search Tool
Summary
CVE-2026-31841: Hyperterse: Raw exposure of database statements in MCP search tool. Affects hyperterse versions >= 2.0.0, < 2.2.0. Fixed in 2.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Hyperterse is an open-source tool that allows users to execute database queries through various functionalities. It is designed to facilitate interactions with databases using natural language, making it accessible for users without extensive technical knowledge. However, the tool's design inadvertently exposed sensitive raw SQL statements, which were meant to be executed in the background, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the search tool in Hyperterse, which, starting from version 2.0.0, returned raw SQL queries alongside search results. This exposure could allow malicious users to view sensitive database statements, potentially leading to unauthorized access or manipulation of the database. The issue was identified and fixed in version 2.2.0, with additional tests implemented to prevent similar occurrences in the future.
How To Fix
Latest published version: 2.5.0 as of 22 Oct 2026
npm install hyperterse@2.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.0
This is the first release that contains the fix.
npm install hyperterse@2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to restrict access to the search tool until the package can be updated. This can be done by modifying the application settings to disable the search functionality until the patch is applied.
Conclusion
The vulnerability identified as CVE-2026-31841 in the Hyperterse package poses a risk by exposing raw SQL statements through its search tool. Users are advised to update to version 2.2.0 or later to mitigate this issue. Temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for hyperterse →
FAQ
CVE-2026-31841 is a vulnerability in the Hyperterse package that exposes raw SQL statements through its search tool, potentially compromising database security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability has a CVSS score of 6.5, indicating a moderate level of risk associated with the exposure of sensitive information.
If you cannot update Hyperterse right away, consider disabling the search functionality as a temporary workaround to mitigate the risk.
More information about Hyperterse, including its features and updates, can be found on its GitHub repository.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
