Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/julien040/anyquery/plugins/edge

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.0GoPublished

    Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

    CVE-2026-47252 · GHSA-hrj8-hjv8-mgwc

    Affected
    • Go github.com/julien040/anyquery/plugins/edge < 0.0.0-20240826075852-c651df0b8767
    Fixed in
    0.0.0-20240826075852-c651df0b8767· Vendor fix available
    Issue
    AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin | Field | Value | | ---------------- | ----- | | Repository | julien040/anyquery | | Affected version | 0.4.4 (commit 0abd460) | | Vulnerability | CWE-94 — Improper Control of Generation of Code | | Severity | High | Summary The chrometabs plugin (and equivalent Brave/Edge/Safari variants) interpolates a SQL-controlled url value directly into an AppleScript template via fmt.Sprintf(newTabScript, url) at plugins/chrome/tabs.go:141 without any escaping, then passes the result to exec.Command("osascript", "-e", ...). An authenticated anyquery user who can issue SQL INSERT INTO chrometabs statements — which requires local CLI access — can break out of the {URL:"..."} property record with a newline-containing payload and inject arbitrary AppleScript statements, including do shell script, achieving OS-level command execution on the macOS host. The same pattern applies to the Update path at tabs.go:169 via the JXA…

    Recommended action: Upgrade to 0.0.0-20240826075852-c651df0b8767 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →