Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript. In plugins/chrome/tabs.go, tabsTable.Insert() passes the URL through fmt.Sprintf(newTabScript, url), and tabsTable.Update() uses fmt.Sprintf(setURLScript, pk, url). A URL containing quote and newline characters can break out of the intended string or property record and append script statements, resulting in arbitrary command execution with the privileges of the anyquery process on the macOS host. This issue is fixed in version 0.4.5.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
anyquery
Vendor
julien040
Product
anyquery
Platforms
Unknown
Default status
Unknown
anyquery · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.4.5
affected
Unavailable
Unavailable
Unavailable
None listed
github.com/julien040/anyquery/plugins/brave
Vendor
anyquery
Product
github.com/julien040/anyquery/plugins/brave
Platforms
Unknown
Default status
Unknown
github.com/julien040/anyquery/plugins/brave · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.2.0
affected
Unavailable
Unavailable
Unavailable
None listed
github.com/julien040/anyquery/plugins/chrome
Vendor
anyquery
Product
github.com/julien040/anyquery/plugins/chrome
Platforms
Unknown
Default status
Unknown
github.com/julien040/anyquery/plugins/chrome · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.2.0
affected
Unavailable
Unavailable
Unavailable
None listed
github.com/julien040/anyquery/plugins/edge
Vendor
anyquery
Product
github.com/julien040/anyquery/plugins/edge
Platforms
Unknown
Default status
Unknown
github.com/julien040/anyquery/plugins/edge · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.2.0
affected
Unavailable
Unavailable
Unavailable
None listed
github.com/julien040/anyquery/plugins/reminders
Vendor
anyquery
Product
github.com/julien040/anyquery/plugins/reminders
Platforms
Unknown
Default status
Unknown
github.com/julien040/anyquery/plugins/reminders · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.2.0
affected
Unavailable
Unavailable
Unavailable
None listed
github.com/julien040/anyquery/plugins/safari
Vendor
anyquery
Product
github.com/julien040/anyquery/plugins/safari
Platforms
Unknown
Default status
Unknown
github.com/julien040/anyquery/plugins/safari · Scoped product and version facts