Executive brief
Anyquery is a tool that allows users to run SQL queries against various data sources, including browser tabs. A vulnerability in its macOS browser plugins allows an attacker to execute arbitrary commands on the host computer by providing a specially crafted URL. This could lead to full system compromise, unauthorized access to files, and theft of sensitive information stored in the macOS keychain.
Technical details
A code injection vulnerability exists in the Anyquery browser plugins (Chrome, Brave, Edge, Safari) for macOS. The vulnerability is caused by the improper neutralization of special characters in a SQL-controlled URL value before it is interpolated into an AppleScript or JXA template. Specifically, the `Insert` and `Update` functions in `plugins/chrome/tabs.go` use `fmt.Sprintf` to embed the URL directly into a script string, which is then executed via `osascript`. An attacker with the ability to execute SQL commands (via local CLI or the HTTP interface) can use newline characters and quotes to break out of the intended script logic and execute arbitrary AppleScript commands, such as `do shell script`. This allows for arbitrary command execution with the privileges of the Anyquery process. The issue is addressed in version 0.0.0-20240826075852-c651df0b8767.
Affected products
- julien040 anyquery/plugins/chrome < 0.0.0-20240826075852-c651df0b8767
- julien040 anyquery/plugins/brave < 0.0.0-20240826075852-c651df0b8767
- julien040 anyquery/plugins/edge < 0.0.0-20240826075852-c651df0b8767
- julien040 anyquery/plugins/safari < 0.0.0-20240826075852-c651df0b8767
Timeline
- 2026-06-07: disclosed
- 2026-06-08: advisory