Bytebase dbhub version 1.2.0 contains a SQL injection flaw in the /utils/sql-parser.ts component, allowing an attacker to send crafted SQL statements that are executed against the application database. Because the input is not validated or parameterized, the attacker can read protected data or modify database entries, thereby compromising confidentiality and potentially integrity of the system.

The vulnerability affects Bytebase dbhub v1.2.0; the flaw resides in the /utils/sql-parser.ts module, which is exposed through a web endpoint and can be accessed remotely. Only installations running the unpatched 1.2.0 build are susceptible.

The flaw has a CVSS score of 9.1, indicating severe impact. The EPSS score is reported as less than 1 %, suggesting a low but non‑zero probability of exploitation at this time, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability can be triggered by sending crafted SQL statements to the /utils/sql-parser component via a web request. Attackers do not require authentication if the vulnerable endpoint is publicly reachable; therefore, the risk is significant for any exposed instance and does not depend on privileged credentials.