# CVE-2025-59333: ExecuteAutomation database-server improper access control bypassing read-only mode

Source: https://junglewise.ai/threats/cve-2025-59333-executeautomation-database-server-improper-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-59333 · Severity: low · CVSS 3.1 · Published 2025-09-16

The @executeautomation/database-server is an MCP (Model Context Protocol) server used to provide AI agents and workflows with database query capabilities. The server claims to enforce "read-only" mode by checking if queries start with "SELECT", but this check is insufficient to prevent dangerous database operations. Attackers with authenticated access can use functions like pg_terminate_backend() or execute stored procedures to disrupt database availability, leak sensitive data about running queries, or cause service outages.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-59333 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59333 being exploited in the wild.

**How severe is CVE-2025-59333?** Low severity, with a CVSS score of 3.1, published 16 September 2025.

**Which products and versions are affected?** @executeautomation/database-server (npm) SEMVER:introduced=0,last_affected=1.1.0.

**Is there a fix for CVE-2025-59333?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-59333 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-59333?** Check whether you run @executeautomation/database-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper access control issue (CWE-284) stemming from a naive string-matching check (startsWith("SELECT")) used to enforce "read-only" mode in the read_query tool. The vulnerable code fails to recognize that PostgreSQL and other databases allow side-effects and administrative operations through SELECT statements—including stored procedures, pg_terminate_backend() to kill connections, and other functions. An authenticated attacker can execute queries like "SELECT pg_terminate_backend(pid)" to cause denial of service or "SELECT some_function_that_updates_data()" to bypass the read-only guarantee. The PostgreSQL pg driver also supports multi-statement queries separated by semicolons, further weakening the defense. No patch has been released as of the advisory date.

## Affected products

- ExecuteAutomation database-server <=1.1.0

## Identifiers

- CVE-2025-59333
- GHSA-65hm-pwj5-73pw

## Timeline

- 2025-09-16: disclosed

## References

- [https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw](https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw)