Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
References
| Link | Resource |
|---|---|
| https://github.com/neuron-core/neuron-ai/commit/44bab85d92bf162898ee48d0bcef6ba0d29b59c9 | Patch |
| https://github.com/neuron-core/neuron-ai/releases/tag/2.8.12 | Product Release Notes |
| https://github.com/neuron-core/neuron-ai/security/advisories/GHSA-898v-775g-777c | Mitigation Vendor Advisory |
Configurations
History
06 Mar 2026, 19:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:neuron-ai:neuron:*:*:*:*:*:*:*:* | |
| First Time |
Neuron-ai
Neuron-ai neuron |
|
| References | () https://github.com/neuron-core/neuron-ai/commit/44bab85d92bf162898ee48d0bcef6ba0d29b59c9 - Patch | |
| References | () https://github.com/neuron-core/neuron-ai/releases/tag/2.8.12 - Product, Release Notes | |
| References | () https://github.com/neuron-core/neuron-ai/security/advisories/GHSA-898v-775g-777c - Mitigation, Vendor Advisory |
10 Dec 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-10 23:15
Updated : 2026-03-06 19:28
NVD link : CVE-2025-67510
Mitre link : CVE-2025-67510
CVE.ORG link : CVE-2025-67510
JSON object : View
Products Affected
neuron-ai
- neuron