DBHub’s MySQL and MariaDB connectors incorrectly treat a double dash as the start of a comment regardless of following whitespace or control characters. The read‑only check splits statements on the original string, but the connector executes the original string with multiple statements enabled. Consequently a double dash followed by a non‑whitespace character can conceal a subsequent write or destructive DDL statement. An attacker who can influence the SQL sent to DBHub—such as through prompt injection—can therefore execute hidden statements that alter or delete database data according to the database account’s privileges.

The vulnerability affects DBHub version 0.22.5 and earlier for the MySQL and MariaDB connectors. The affected product is bytebase:dbhub. The issue is resolved in release 0.22.6.

The CVSS score is 6.1, indicating a moderate severity level. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation. The likely attack vector involves injecting SQL through an interface that forwards queries to DBHub, such as a chat‑assistant or application that processes user content. Attackers can bypass read‑only mode and perform writes or destructive DDL based on the privileges of the database account used by DBHub.