CVE-2026-61788: @bytebase/dbhub Read-Only Mode Bypass Vulnerability
Summary
CVE-2026-61788: @bytebase/dbhub's read-only mode does not prevent database writes. Affects @bytebase/dbhub versions < 0.22.6. Fixed in 0.22.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @bytebase/dbhub package is a tool designed for database management, allowing users to execute SQL commands and manage database schemas effectively. It is widely used for its ability to connect to various database systems, including PostgreSQL and SQLite. However, a significant vulnerability exists in its read-only mode, which fails to enforce true read-only access, potentially exposing databases to unauthorized write operations.
Vulnerability Detail
The vulnerability arises from a failure in the @bytebase/dbhub package to enforce read-only access correctly when the 'readonly' setting is enabled. The connection does not set the appropriate database-level read-only controls, allowing unauthorized users to execute write operations. This issue is compounded by a classifier that only inspects the first keyword of SQL statements, leading to dangerous scenarios where seemingly read-only commands can perform write operations. The implications are severe, as they can lead to unauthorized data modification, file access, and even remote code execution, especially when using privileged database roles.
How To Fix
Latest published version: 1.5.0 as of 23 Oct 2026
npm install @bytebase/dbhub@1.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.22.6
This is the first release that contains the fix.
npm install @bytebase/dbhub@0.22.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the read-only mode in @bytebase/dbhub until the package is updated. Ensure that only trusted users have access to the execute_sql functionality and monitor database access closely.
Conclusion
The @bytebase/dbhub package has a critical vulnerability that allows unauthorized write operations even when read-only mode is enabled. It is essential to update to the latest version to mitigate this risk and ensure the security of your database. Regular monitoring and awareness of such vulnerabilities are crucial for maintaining a secure application environment.
See every vulnerability recorded for @bytebase/dbhub →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
The vulnerability affects both PostgreSQL and SQLite databases when using the @bytebase/dbhub package.
Yes, if exploited, this vulnerability can lead to unauthorized data modification and potential data loss.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for @bytebase/dbhub.
