Is CVE-2025-59333 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-59333 being exploited in the wild.

How severe is CVE-2025-59333?

Low severity, with a CVSS score of 3.1, published 16 September 2025.

Which products and versions are affected?

@executeautomation/database-server (npm) SEMVER:introduced=0,last_affected=1.1.0.

Is there a fix for CVE-2025-59333?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-59333 attacked?

It is attacked over the network.

Am I affected by CVE-2025-59333?

Check whether you run @executeautomation/database-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59333: ExecuteAutomation database-server improper access control bypassing read-only mode

CVE-2025-59333 · Severity: low · CVSS 3.1 · Published 2025-09-16

The @executeautomation/database-server is an MCP (Model Context Protocol) server used to provide AI agents and workflows with database query capabilities. The server claims to enforce "read-only" mode by checking if queries start with "SELECT", but this check is insufficient to prevent dangerous database operations. Attackers with authenticated access can use functions like pg_terminate_backend() or execute stored procedures to disrupt database availability, leak sensitive data about running queries, or cause service outages.

Vendors: npm.

Quick answers

Is CVE-2025-59333 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-59333 being exploited in the wild.
How severe is CVE-2025-59333?: Low severity, with a CVSS score of 3.1, published 16 September 2025.
Which products and versions are affected?: @executeautomation/database-server (npm) SEMVER:introduced=0,last_affected=1.1.0.
Is there a fix for CVE-2025-59333?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-59333 attacked?: It is attacked over the network.
Am I affected by CVE-2025-59333?: Check whether you run @executeautomation/database-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control issue (CWE-284) stemming from a naive string-matching check (startsWith("SELECT")) used to enforce "read-only" mode in the read_query tool. The vulnerable code fails to recognize that PostgreSQL and other databases allow side-effects and administrative operations through SELECT statements—including stored procedures, pg_terminate_backend() to kill connections, and other functions. An authenticated attacker can execute queries like "SELECT pg_terminate_backend(pid)" to cause denial of service or "SELECT some_function_that_updates_data()" to bypass the read-only guarantee. The PostgreSQL pg driver also supports multi-statement queries separated by semicolons, further weakening the defense. No patch has been released as of the advisory date.

Affected products

ExecuteAutomation database-server <=1.1.0

Identifiers

CVE-2025-59333
GHSA-65hm-pwj5-73pw

Timeline

2025-09-16: disclosed

References

https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.