CVE-2026-47252

Executive Summary

CVE-2026-47252 is a critical code injection vulnerability (CWE-94) in Anyquery, an SQL query engine built on SQLite, affecting versions prior to 0.4.5. Authenticated users with INSERT or UPDATE privileges on affected macOS virtual tables (Chrome, Brave, Edge, Safari plugins) can inject malicious URLs that are interpolated into AppleScript or JXA source and executed via osascript, leading to arbitrary operating-system command execution with the privileges of the Anyquery process. With a CVSS score of 9.0 and scope change (S:C) reflecting privilege boundary crossing from application to host OS, this represents a severe local/remote hybrid risk for macOS environments running Anyquery with browser automation plugins.

Technical Analysis

The vulnerability resides in how Anyquery's browser integration plugins construct AppleScript/JXA scripts for controlling macOS browser applications. Specifically, in plugins/chrome/tabs.go, the tabsTable.Insert() method passes a user-supplied URL through fmt.Sprintf(newTabScript, url), and tabsTable.Update() uses fmt.Sprintf(setURLScript, pk, url). Because URL values are directly interpolated into script source without sanitization or escaping, an attacker who can issue SQL INSERT or UPDATE statements against these virtual tables can supply a URL containing quote and newline characters.

The attack mechanism is a classic script injection: when the URL is embedded into the AppleScript/JXA string literal, a crafted value containing a closing quote (") and newline (\n) can terminate the intended string or property record and append arbitrary AppleScript or JavaScript-for-Automation (JXA) statements. The resulting script source is then passed to the osascript interpreter, which executes it on the macOS host with the privileges of the Anyquery process. This is not a memory-safety issue; it is an injection flaw arising from improper neutralization of special elements (CWE-94) within a code generation context.

The attack surface is the SQL interface exposed by Anyquery. Because Anyquery is an SQL query engine, any authenticated user or application able to issue SQL statements with INSERT or UPDATE access to the Chrome plugin's virtual tables — and equivalent Brave, Edge, and Safari variants — can trigger the flaw. The requirement for authentication and user interaction (UI:R) reflects that exploitation typically depends on an operator issuing the crafted SQL and the osascript call being invoked. However, the scope change (S:C) indicates the vulnerability allows an attacker to cross a security boundary from the database/application context into the host operating system, substantially increasing severity.

Note: The NVD description explicitly identifies only the Chrome plugin file path and method names (plugins/chrome/tabs.go, tabsTable.Insert(), tabsTable.Update(), newTabScript, setURLScript). Equivalent Brave, Edge, and Safari variants are described as sharing the same vulnerable pattern but their specific file paths and symbol names are not provided in the available data. No public PoC or exploit code is known at this time; the analysis below is derived from the vulnerability class and the disclosed code locations.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a macOS host running a vulnerable Anyquery version (prior to 0.4.5) with one or more browser automation plugins (Chrome, Brave, Edge, Safari) enabled. Access requires the ability to submit SQL to Anyquery with INSERT or UPDATE privileges on the relevant virtual tables — for example, a multi-tenant query service, a shared automation pipeline, or an application embedding Anyquery.

2. Triggering the flaw: The attacker constructs a SQL INSERT or UPDATE statement targeting the affected virtual table (e.g., the Chrome tabs table). The URL value is crafted to include a " character to close the intended AppleScript/JXA string literal or property record, followed by a newline and additional script statements. Because the value flows directly into fmt.Sprintf(newTabScript, url) (Insert) or fmt.Sprintf(setURLScript, pk, url) (Update), the injected content becomes part of the script source.

3. Payload/execution: When the plugin invokes osascript to apply the tab operation, the injected AppleScript/JXA executes as part of the same interpreter call. At the vulnerability-class level, this permits arbitrary command execution on the macOS host — for example, invoking shell commands, reading/writing files, or launching further payloads — subject to the privileges of the Anyquery process.

4. Post-exploitation impact: Successful exploitation yields code execution in the security context of the Anyquery service. Depending on that context (e.g., a launch daemon or user session), the attacker could pivot to credential theft, persistence, lateral movement, or data exfiltration. The scope change (S:C) means the impact is not confined to the Anyquery application but extends to the host OS.

No public PoC is available; the attack chain above is inferred from the disclosed vulnerable code paths and the CWE-94 class.

Impact Assessment

CVE-2026-47252 carries a CVSS v3.1 base score of 9.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. Network exploitability (AV:N) combined with low attack complexity (AC:L) and only low privileges required (PR:L) makes this attractive to attackers who already hold limited access to an Anyquery instance. The user-interaction requirement (UI:R) slightly tempers remote exploitation but does not prevent it in automation contexts. Scope change (S:C) is the most severe component: exploitation crosses from the SQL/application layer into the host operating system, meaning the vulnerability can compromise resources beyond Anyquery's intended authorization boundary.

Confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H). Command execution with Anyquery's privileges could expose sensitive browser data, credentials, and filesystem contents (C:H), allow modification or destruction of system state (I:H), and enable denial of service via process termination or resource exhaustion (A:H). The blast radius includes any macOS host running a vulnerable Anyquery version with browser plugins, as well as downstream systems reachable with the privileges of the Anyquery process. Because browser plugins often harvest session cookies and saved credentials, a compromised instance can lead to broader account takeover across an organization. EPSS has not yet scored this CVE; no CISA KEV listing exists, and no in-the-wild exploitation has been reported.

Detection Guidance

Sigma Rule

title: Potential Anyquery macOS Virtual Table Command Injection (CVE-2026-47252)
id: 7b6c1f2a-9d3e-4c5b-8a1f-2e6d9c0b4f11
status: experimental
description: Detects osascript executions initiated by Anyquery processes that may indicate SQL-controlled URL interpolation into AppleScript/JXA source.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-47252
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith: '/osascript'
  selection_parent:
    ParentImage|endswith:
      - '/anyquery'
  selection_args:
    CommandLine|contains:
      - 'tell application'
      - 'Application('
  condition: selection_img and selection_parent and selection_args
falsepositives:
  - Legitimate Anyquery browser automation operations
level: high
tags:
  - attack.t1059
  - cve.2026.47252

YARA Rule

rule CVE_2026_47252_Anyquery_Script_Injection
{
    meta:
        description = "Detects crafted URLs containing quote/newline breakouts targeting Anyquery browser plugin script generation"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-47252"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $new_tab = "newTabScript"
        $set_url = "setURLScript"
        $osascript = "osascript"
        $tell = "tell application"
        $jxa = "Application("
        $breakout1 = /"\s*\n\s*(do shell script|tell application)/
        $breakout2 = /"\s*\n\s*\w+\s*=/
    condition:
        (uint32(0) == 0x464C457F or uint32(0) == 0xFEEDFACF or uint32(0) == 0xCAFEBABE) and
        (2 of ($new_tab, $set_url, $osascript)) and
        (any of ($breakout1, $breakout2)) or
        (any of ($new_tab, $set_url) and any of ($tell, $jxa))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-47252 Anyquery SQL Virtual Table URL Injection Attempt"; flow:to_server,established; content:"INSERT"; nocase; content:"tabs"; nocase; content:"\"|0a|"; distance:0; within:512; classtype:attempted-admin; reference:cve,2026-47252; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-47252; sid:202647252; rev:1;)

Elastic Detection

process where process.parent.name == "anyquery" and process.name == "osascript" and
  process.args : ("*tell application*" or "*Application(*") and
  process.command_line : "*\n*"

Splunk SPL Query

index=macos OR index=endpoint (Image="/usr/bin/osascript" OR process_name=osascript)
| search parent_process_name=anyquery OR ParentImage="*anyquery*"
| regex CommandLine="(?i)(tell application|Application\()"
| search CommandLine="*\"*\n*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, CommandLine, parent_process_name
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="cve-2026-47252,anyquery,">
  <rule id="202647252" level="12">
    <if_sid>60000</if_sid>
    <field name="parent_process">anyquery</field>
    <field name="command">osascript</field>
    <description>CVE-2026-47252: Anyquery osascript execution with script content - possible SQL-controlled URL command injection</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_47252,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the NVD description states the issue is fixed in Anyquery version 0.4.5, no patch source is currently tracked in our data; treat patch verification as pending vendor confirmation.

1. Immediate mitigations:

• Restrict INSERT and UPDATE privileges on Anyquery browser virtual tables to trusted, non-shared accounts only.
• Disable Chrome, Brave, Edge, and Safari plugins if browser automation is not required.
• Run Anyquery with the least privilege possible (dedicated low-privileged user account), reducing the impact of any command execution.
• Monitor macOS process telemetry for anyquery spawning osascript (see detection rules above) and alert on quote/newline patterns in URLs.
• Network-restrict SQL access to the Anyquery engine to trusted hosts only.

2. Patch/upgrade steps:

• Upgrade Anyquery to version 0.4.5 or later as stated in the advisory. Verify the installed binary version before and after upgrading.
• After upgrade, validate that URLs containing quote and newline characters are properly escaped or rejected in the plugin code path.
• Re-enable disabled plugins only after confirming the fixed version is in place.

3. Long-term hardening:

• Enforce parameterized/escaped construction for any script source generation; avoid string interpolation into interpreted code.
• Implement input validation for URL fields in virtual tables, rejecting control characters.
• Apply the principle of least privilege to the Anyquery service account and sandbox its OS-level command execution.
• Establish continuous monitoring for anomalous osascript invocations and maintain an SBOM for embedded SQL engines.

References

• NVD — CVE-2026-47252: https://nvd.nist.gov/vuln/detail/CVE-2026-47252
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• Anyquery project repository/advisory (vendor confirmation of 0.4.5 fix recommended; no direct advisory URL provided in available data)

No known threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-47252. The CVE is not listed in CISA KEV, has no public PoC or exploit code, and no Nuclei template is available at the time of writing.