Tabularis MCP read-only metadata tool could execute stacked SQLite statements

Tabularis interpolated the table_name argument into SQLite PRAGMA metadata queries that its SQL driver could execute as stacked statements.

The tool caller needed access to describe_table; the user-facing workflow might have disallowed the separate write-capable run_query tool. Crafted metadata arguments could cross the nominal read-only MCP tool policy and issue statements through the same database connection.

The advisory provides SQLite-driver evidence, not confirmation that a compiled vulnerable production binary was exploited. Use Tabularis 0.28.0 or newer, strictly validate identifiers and apply SQLite read-only connection permissions when writes are not authorized.

Evidence interpretation and control boundary. The supposed read-only boundary covered one MCP tool name, but describe_table assembled SQL from a caller-controlled table identifier. Where the SQLite driver accepts stacked statements, the same metadata operation can perform writes with the configured database authority. The advisory includes a lower-level SQLite proof and does not establish that an attacker compromised a deployed Tabularis instance.