DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In src/utils/sql-parser.ts, scanSingleLineComment treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in src/tools/execute-sql.ts validates split statements with isReadOnlySQL, but src/connectors/mysql/index.ts and src/connectors/mariadb/index.ts execute the original string with multipleStatements enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus…