rootpwn

critical · CVSS v3 9 · EPSS 0.00047

CVE-2026-47252

CVE-2026-47252 enables authenticated macOS users of Anyquery to run arbitrary OS commands by injecting crafted URLs into the Chrome, Brave,

Overview

CVE-2026-47252 enables authenticated macOS users of Anyquery to run arbitrary OS commands by injecting crafted URLs into the Chrome, Brave, Edge, and Safari plugins. The vulnerability stems from unsanitized URL interpolation into AppleScript/JXA executed via osascript, allowing command execution with the Anyquery process’s privileges. It affects Anyquery versions prior to 0.4.5 on macOS.

Description

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript. In plugins/chrome/tabs.go, tabsTable.Insert() passes the URL through fmt.Sprintf(newTabScript, url), and tabsTable.Update() uses fmt.Sprintf(setURLScript, pk, url). A URL containing quote and newline characters can break out of the intended string or property record and append script statements, resulting in arbitrary command execution with the privileges of the anyquery process on the macOS host. This issue is fixed in version 0.4.5.

Impact

The flaw compromises confidentiality, integrity, and availability of the affected macOS system. Authenticated users with INSERT or UPDATE rights can execute arbitrary commands, potentially exfiltrating data, modifying files, or disrupting services. System administrators and end‑users of Anyquery are directly impacted.

Remediation

Upgrade Anyquery to version 0.4.5 or later. If an upgrade is not immediately possible, revoke INSERT/UPDATE permissions on the virtual tables or disable the vulnerable plugins. Monitor for suspicious osascript activity and apply any vendor patches as soon as they become available.

Risk context

The vulnerability is rated critical (CVSS 9.0) but has a low EPSS score of 0.00047, indicating a low likelihood of exploitation in the wild. Nonetheless, the potential impact warrants prompt remediation.

Affected products

  • Anyquery 0.4.4 macOS
  • Anyquery Chrome plugin
  • Anyquery Brave plugin
  • Anyquery Edge plugin
  • Anyquery Safari plugin

Scores

Severity
critical
CVSS v2
9
CVSS v3
9
CVSS v4
—
EPSS
0.00047

macOS Anyquery SQL injection AppleScript command execution critical plugin

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis