CVE-2025-67509 MySQLSelectTool Read-Only Bypass via SELECT INTO OUTFILE Allows Arbitrary File Write
Attackers can bypass read-only SQL restrictions to write arbitrary files on the server via prompt injection, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67509?
CVE-2025-67509 is a high-severity code injection vulnerability in neuron-core neuron-ai, published on 10 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
Weakness: CWE-94
Which versions are affected by CVE-2025-67509?
2 open source packages ship an affected version, including neuron-core/neuron-ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
neuron-core/neuron-ai Packagist | All versions | 2.8.12 |
neuron-core/neuron-ai Packagist | All versions | 2.8.12 |
Products include Neuron-Ai Neuron.
How do I fix CVE-2025-67509?
Upgrade neuron-core/neuron-ai to 2.8.12 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-67509 being exploited?
There is no known exploitation of CVE-2025-67509 in the wild and no public exploit code.
Other vulnerabilities in neuron-core neuron-ai
Sources
Also known as GHSA-j8g6-5gqc-mq36.