mysqltuner_mcp

The `UserPrivilegesToolHandler` has a SQL injection vulnerability. Specifically, methods like `_get_user_privileges` construct SQL queries using f-strings to directly embed `username` and `hostname` values into the `WHERE` clause without proper escaping or parameterization (e.g., `WHERE User = '{username}' AND Host = '{hostname}'`). This allows an attacker to inject arbitrary SQL if they can control these inputs, potentially leading to unauthorized data access or manipulation. While most queries use parameterized statements via `SqlDriver`, this specific pattern bypasses that protection. No usage of `eval` or direct obfuscation was found. Database connection configuration, including SSL/TLS, is handled securely via environment variables and standard Python `ssl` module.