CVE-2025-59333 @executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
Attackers can bypass read-only restrictions in the MCP database server, leading to denial of service and unauthorized data modification on connected databases.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59333?
CVE-2025-59333 is a high-severity missing authorization vulnerability in executeautomation mcp-database-server, published on 16 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distribution; other distributions are not impacted. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and potentially others that expose elevated functionalities. These attacks may lead to denial of service and other unexpected behaviors.
Weakness: CWE-284
Which versions are affected by CVE-2025-59333?
2 open source packages ship an affected version, including @executeautomation/database-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@executeautomation/database-server npm | All versions to 1.1.0 | None |
@executeautomation/database-server npm | All versions to 1.1.0 | None |
Products include Executeautomation Mcp Database Server.
How do I fix CVE-2025-59333?
No fix has been published for CVE-2025-59333 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-59333 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59333 exists.
Sources
Also known as GHSA-65hm-pwj5-73pw.