4 min read
News Brief CVE-2026-118378 is a SQL injection in the SQLite driver of Tabularis, a SQL workspace with a built-in MCP server. A prompt-steered agent could append statements through the describe_table tool and skip read-only mode. Fixed in 0.28.0 on October 13; two more MCP advisories followed.