Executive brief
Hyperterse is a tool that allows users to specify and execute database queries through an AI-powered search interface. A vulnerability in versions 2.0.0 through 2.1.x causes raw SQL database statements to be exposed in search results, allowing unauthorized disclosure of database query logic that should remain hidden. This could reveal sensitive database structure and query patterns to attackers.
Technical details
The vulnerability is an information disclosure (CWE-433: Unparsed Raw Web Content Delivery) in Hyperterse's MCP search tool. The search tool, which allows LLMs to search for available tools using natural language, returns raw SQL database statements alongside its results, exposing queries that should be executed server-side and hidden from external visibility. An unauthenticated attacker with network access to the Hyperterse instance can query the search tool to directly extract underlying database query logic. The issue affects versions 2.0.0 through 2.1.x and has been patched in version 2.2.0.
Affected products
- Hyperterse Hyperterse 2.0.0 to 2.1.x
Timeline
- 2026-03-12: disclosed
- 2026-03-12: patched: Fix released in v2.2.0