Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin
Date: 2026-06
Affected: go/github.com/julien040/anyquery/plugins/safari, go/github.com/julien040/anyquery/plugins/edge, go/github.com/julien040/anyquery/plugins/brave
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-47252
CWE: CWE-94
CVSS: 9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)

# AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin | Field | Value | | ---------------- | ----- | | Repository | julien040/anyquery | | Affected version | 0.4.4 (commit 0abd460) | | Vulnerability | CWE-94 — Improper Control of Generation of Code | | Severity | High | ## Summary The `chrome_tabs` plugin (and equivalent Brave/Edge/Safari variants) interpolates a SQL-controlled `url` value directly into an AppleScript template via `fmt.Sprintf(newTabScript, url)` at `plugins/chrome/tabs.go:141` without any escaping, then passes the result to `exec.Command("osascript", "-e", ...)`. An authenticated anyquery user who can issue SQL `INSERT INTO chrome_tabs` statements — which requires local CLI access — can break out of the `{URL:"..."}` property record with a newline-containing payload and inject arbitrary AppleScript statements, including `do shell script`, achieving OS-level command execution on the macOS host. The same pattern applies to the `Update` path at `tabs.go:169` via the JXA `setURL.js` script. ## Affected Code `plugins/chrome/tabs.go:141` — SQL-supplied `url` interpolated unescaped into AppleScript template, then executed via `osascript -e` ```go func (t *tabsTable) Insert(rows [][]interface{}) error { for _, row := range rows { url := "chrome://newtab/" if rawURL, ok := row[2].(string); ok { url = rawURL } cmd := exec.Command("osascript", "-e", fmt.Sprintf(newTabScript, url)) output, err := cmd.C


Mitigations:

Architectural layers (MAESTRO):