What happened
The Tabularis SQLite driver builds a PRAGMA statement by interpolating an unsanitized table_name, allowing an MCP client to inject stacked SQL statements (CWE-89, CVSS 7.8). This is a prompt-injection-reachable injection where untrusted content drives the agent's tool call to alter or exfiltrate the stored data.
Why it matters
This is a concrete example of the MCP tool-injection class: untrusted content steering an agent's tool parameters can escalate from a read-only describe call to full read/modify/drop of the agent's SQLite state, bypassing the intended guardrails.
Attack vector
An MCP client, or an AI agent steered by untrusted content, supplies a crafted table_name to the describe_table tool; the quoted PRAGMA argument can be closed and stacked statements appended to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
Affected systems
Tabularis < 0.28.0 (SQLite driver MCP surface)
Mitigation
Upgrade to Tabularis 0.28.0 (GHSA-xrx3-j98v-67x9) and parameterize the PRAGMA/table_name input.