What’s Vulnerable › Vulnerabilities

CVE-2025-59333: @executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-16 · updated 2026-06-17
• Weakness: CWE-284

Description

The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distribution; other distributions are not impacted. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and potentially others that expose elevated functionalities. These attacks may lead to denial of service and other unexpected behaviors.

Affected products

• executeautomation mcp-database-server: through 1.1.0

References

• https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw
• https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw

Get alerted when CVE-2025-59333 or the next vulnerability affects your stack