CVE-2025-67509: RCE in neuron-core/neuron-ai

The MySQLSelectTool component, designed for read-only SQL queries, suffers from inadequate input validation. While intended to block malicious SQL commands, the validation mechanism fails to prevent file-writing constructs like INTO OUTFILE or INTO DUMPFILE. This flaw allows an attacker who can influence the tool's input – for example, through prompt injection in a public agent endpoint – to write arbitrary content to files on the database server. The severity of this vulnerability is amplified if the MySQL/MariaDB account possesses the FILE privilege and the server configuration permits writes to a publicly accessible directory, such as a web server's document root. Successful exploitation could lead to remote code execution, data exfiltration, and complete system takeover.

1. Reserved2025-12-08
2. Published2025-12-09
3. Modified2025-12-11
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67509 is to upgrade to neuron-core/neuron-ai version 2.8.12 or later, which includes the necessary input validation fixes. If immediate upgrading is not feasible, consider implementing temporary workarounds. Restrict the MySQL/MariaDB account's privileges, specifically revoking the FILE privilege. Configure the database server to prevent writes to publicly accessible directories. Implement a Web Application Firewall (WAF) or proxy to filter potentially malicious SQL queries, specifically targeting INTO OUTFILE and INTO DUMPFILE statements. After upgrading, confirm the fix by attempting a controlled injection of a SELECT ... INTO OUTFILE statement through the agent endpoint and verifying that the file write is blocked.

Last updated

3.14.4recently