ETK-2026-3218Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3218",
  "cve_id": null,
  "display_id": "ETK-2026-3218",
  "ghsa_id": "GHSA-gg4q-84m8-8jhv",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "SQL statement authorization bypass in TablePro for macOS",
  "summary": "TablePro for macOS can misinterpret certain SQL syntax while checking statements submitted by external clients, AppleScript, Shortcuts, or the AI assistant. An authorized and enabled caller may bypass intended read-only or confirmation controls, allowing database writes or destructive actions. The MCP server must be enabled and the client paired and permitted on the connection; AI-assisted exposure also depends on the assistant being allowed for that connection.",
  "mitigation": "Upgrade macOS to 0.83.1, 0.84.0-beta.2 or later.",
  "vendor": "other",
  "product": "other:TablePro for macOS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.83.0",
        "0.84.0-beta.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "0.83.1",
        "0.84.0-beta.2"
      ],
      "package_name": "TablePro for macOS",
      "purl": null
    }
  ],
  "cwes": [
    184
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 81.37498608333334,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-01T07:16:32+00:00",
      "days": -0.19316289056712962,
      "is_lower_bound": true,
      "measured_at": "2026-11-01T11:54:41.406230+00:00",
      "url": "https://github.com/TableProApp/TablePro/security/advisories/GHSA-gg4q-84m8-8jhv"
    }
  }
}