6.5

CVE-2026-31841

Raw exposure of database statements in Hyperterse MCP search tool

Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing statements which were supposed to be executed under the hood, and protected from being displayed publicly. This issue has been fixed as of v2.2.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hyperterse ≫ Hyperterse Version < 2.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.075
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-433 Unparsed Raw Web Content Delivery

The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.

https://github.com/hyperterse/hyperterse/releases/tag/v2.2.0
Product
Release Notes
https://github.com/hyperterse/hyperterse/security/advisories/GHSA-92gp-jfgx-9qpv
Patch
Vendor Advisory