--- title: SQL injection in the Trilogy MySQL adapter | daily.dev description: A critical SQL injection vulnerability, GHSA-744p-w4gc-m3gh, affects Trilogy, the MySQL client GitHub uses in production. It carries a CVSS score of 9.3, hits... canonical: https://daily.dev/posts/sql-injection-in-the-trilogy-mysql-adapter-ovgpcs04t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SQL injection in the Trilogy MySQL adapter | daily.dev og:description: A critical SQL injection vulnerability, GHSA-744p-w4gc-m3gh, affects Trilogy, the MySQL client GitHub uses in production. It carries a CVSS score of 9.3, hits... og:url: https://daily.dev/posts/sql-injection-in-the-trilogy-mysql-adapter-ovgpcs04t og:image: https://api.daily.dev/og/posts/ovgPCS04T.png og:image:alt: SQL injection in the Trilogy MySQL adapter og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SQL injection in the Trilogy MySQL adapter **[RUBYLAND](https://daily.dev/sources/rubyla)** · 8 min read · 0 upvotes · 0 comments ## Summary A critical SQL injection vulnerability, GHSA-744p-w4gc-m3gh, affects Trilogy, the MySQL client GitHub uses in production. It carries a CVSS score of 9.3, hits every version up to 2.13.1, and is fixed in 2.13.2. The bug lives in Trilogy#escape, which escapes strings byte by byte and tags the result with the input's encoding instead of the connection's. In multibyte encodings like GBK, Shift_JIS, Big5 or GB18030, a lead byte can swallow the inserted backslash, leaving a quote unescaped. A proof of concept shows a header value forced into GBK encoding bypassing Rails' UTF-8 parameter validation and letting sqlmap dump an entire users table. The fix re-encodes strings to the connection's charset before escaping and raises an error on unsafe input; parameterized queries avoid the problem entirely. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is GHSA-744p-w4gc-m3gh and which versions of the Trilogy MySQL gem does it affect? GHSA-744p-w4gc-m3gh is a critical SQL injection vulnerability in Trilogy's escape method, rated CVSS 9.3. It affects every version up to and including 2.13.1 and is fixed in 2.13.2. No CVE has been assigned yet. Anthropic's OSS Scanner discovered the issue, which stems from escape operating byte by byte and tagging output with the wrong string encoding. _Teams running Trilogy in production can track advisories like this one on daily.dev before they bite._ ### Why does Trilogy's escape method fail to prevent SQL injection with multibyte encodings like GBK or Shift_JIS? Escape inserts a backslash byte by byte and tags the result with the input string's encoding rather than the connection's. In multibyte encodings such as Shift_JIS, Windows-31J, Big5, GBK, and GB18030, a trailing lead byte can land on 0x5c, the backslash, so it gets absorbed into a multibyte character and the following quote escapes unescaped, breaking out of the query. _Developers debugging encoding-related injection bugs can follow deep technical writeups like this via daily.dev._ ### How do I fix or mitigate the Trilogy SQL injection vulnerability if I can't upgrade immediately? Upgrade to trilogy 2.13.2, which re-encodes strings to the connection's encoding before escaping and raises an error instead of injecting on unsafe input; it also rejects dangerous connection charsets like sjis, cp932, big5, gbk, and gb18030 at connection time. If upgrading isn't possible yet, enforce the encoding of every string passed to Trilogy#escape and Trilogy#query, or better, use parameterized queries instead of manual escaping. _Developers deciding how fast to patch a critical dependency can track fixes and workarounds through daily.dev._ ## Similar posts on daily.dev - [From Bug to Schema: Exploring Error-Based SQL Injection on an Authenticating Portal](https://daily.dev/posts/from-bug-to-schema-exploring-error-based-sql-injection-on-an-authenticating-portal-xbvfkmcgs) · InfoSec Write-ups · 0 upvotes · 0 comments - [SQL Injection: Why It Persists and How to Prevent It](https://daily.dev/posts/sql-injection-why-it-persists-and-how-to-prevent-it-a5i6fyqpz) · Latest Hacking News · 0 upvotes · 0 comments - [Drupal: Critical SQL injection flaw now targeted in attacks](https://daily.dev/posts/drupal-critical-sql-injection-flaw-now-targeted-in-attacks-eovujytlt) · BleepingComputer · 0 upvotes · 0 comments - [Inside an Oracle Database SQL Injection Attack](https://daily.dev/posts/inside-an-oracle-database-sql-injection-attack-jmtkujhqh) · Huntress Blog · 0 upvotes · 0 comments - [How ORMs Still Let SQL Injection Through \(and How to Close the Gaps\)](https://daily.dev/posts/how-orms-still-let-sql-injection-through-and-how-to-close-the-gaps--uwxttxmz8) · freeCodeCamp · 67 upvotes · 2 comments --- Tags: [#sql](https://daily.dev/tags/sql), [#rails](https://daily.dev/tags/rails), [#mysql](https://daily.dev/tags/mysql) [View this post on daily.dev](https://daily.dev/posts/sql-injection-in-the-trilogy-mysql-adapter-ovgpcs04t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SQL injection in the Trilogy MySQL adapter","url":"https://daily.dev/posts/sql-injection-in-the-trilogy-mysql-adapter-ovgpcs04t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sql-injection-in-the-trilogy-mysql-adapter-ovgpcs04t"},"datePublished":"2026-10-30T10:30:25.941Z","dateModified":"2026-10-30T10:30:59.053Z","description":"A critical SQL injection vulnerability, GHSA-744p-w4gc-m3gh, affects Trilogy, the MySQL client GitHub uses in production. It carries a CVSS score of 9.3, hits...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7c83471b04a393abf5879be13b551594?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7c83471b04a393abf5879be13b551594?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sql-injection-in-the-trilogy-mysql-adapter-ovgpcs04t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"sql,rails,mysql","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"SQL injection in the Trilogy MySQL adapter"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/sql-injection-in-the-trilogy-mysql-adapter-ovgpcs04t#faq","mainEntity":[{"@type":"Question","name":"What is GHSA-744p-w4gc-m3gh and which versions of the Trilogy MySQL gem does it affect?","acceptedAnswer":{"@type":"Answer","text":"GHSA-744p-w4gc-m3gh is a critical SQL injection vulnerability in Trilogy's escape method, rated CVSS 9.3. It affects every version up to and including 2.13.1 and is fixed in 2.13.2. No CVE has been assigned yet. Anthropic's OSS Scanner discovered the issue, which stems from escape operating byte by byte and tagging output with the wrong string encoding. Teams running Trilogy in production can track advisories like this one on daily.dev before they bite."}},{"@type":"Question","name":"Why does Trilogy's escape method fail to prevent SQL injection with multibyte encodings like GBK or Shift_JIS?","acceptedAnswer":{"@type":"Answer","text":"Escape inserts a backslash byte by byte and tags the result with the input string's encoding rather than the connection's. In multibyte encodings such as Shift_JIS, Windows-31J, Big5, GBK, and GB18030, a trailing lead byte can land on 0x5c, the backslash, so it gets absorbed into a multibyte character and the following quote escapes unescaped, breaking out of the query. Developers debugging encoding-related injection bugs can follow deep technical writeups like this via daily.dev."}},{"@type":"Question","name":"How do I fix or mitigate the Trilogy SQL injection vulnerability if I can't upgrade immediately?","acceptedAnswer":{"@type":"Answer","text":"Upgrade to trilogy 2.13.2, which re-encodes strings to the connection's encoding before escaping and raises an error instead of injecting on unsafe input; it also rejects dangerous connection charsets like sjis, cp932, big5, gbk, and gb18030 at connection time. If upgrading isn't possible yet, enforce the encoding of every string passed to Trilogy#escape and Trilogy#query, or better, use parameterized queries instead of manual escaping. Developers deciding how fast to patch a critical dependency can track fixes and workarounds through daily.dev."}}]} ```