Vulnerability in Executeautomation Mcp-Database-Server
CVE-2025-59333
The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distribution; other distributions are not impacted. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and potentially others that expose elevated functionalities. These attacks may lead to denial of service and other unexpected behaviors.
EPSS: 0.004 (32.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.
Affected products
- Executeautomation Mcp-database-server — versions <= 1.1.0
- Executeautomation Mcp_database_server
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-59333?
- CVE-2025-59333 is a high-severity vulnerability in Executeautomation Mcp-Database-Server, classified under Improper Access Control. CVSS score: 8.1/10. Published 2025-09-16.
- How severe is CVE-2025-59333?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2025-59333 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.