The vulnerability lies in the extract_to_json function in the entry.py module of dubydu sqlite-mcp. Manipulating the output_filename argument allows an attacker to inject arbitrary SQL statements because the filename is directly incorporated into an SQL query; the flaw is therefore classified as CWE‑89 SQL injection. The vulnerability may also permit command injection, as the filename is used in a context that could be interpreted by the database engine or operating system, warranting a CWE‑74 categorization. By executing injected SQL, an attacker can read, modify, or delete table data, compromising the confidentiality and integrity of the database.

The issue affects the dubydu sqlite-mcp package for any version up to and including 0.1.0. Any instance running 0.1.0 or earlier is vulnerable and may be exploited if the extract_to_json function is reachable from an untrusted source.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible, and the exploit has already been released publicly. The attack vector is likely through untrusted input to the extract_to_json routine, which directly evaluates the supplied filename as part of a SQL statement. Given the public availability of the exploit code, the likelihood of attack is non‑negligible, especially in environments where the application is exposed to external users.