CVE-2025-3164 is a Medium severity (CVSS 4.7) code injection in Tencent Music Entertainment SuperSonic, up to version 0.9.8. The database connection test accepts an H2 connection URL that can trigger script execution. The record gives no fixed version, so restrict access and validate URLs.
What's affected
The record names Tencent Music Entertainment SuperSonic up to and including version 0.9.8. The affected function is the /api/semantic/database/testConnect endpoint, part of the H2 database connection handler. The description says that manipulation leads to code injection, can be launched remotely, and that the exploit has been disclosed publicly and may be used.
The public GitHub issue the record points to explains the cause at a high level: the test connection feature accepts a JDBC URL for the H2 database, and H2 connection URL parameters can load and run an initialization script. The reporter recommends validating the URL against an allowlist so that only simple in memory database names and safe parameters are allowed. This post does not repeat the reporter's test values.
The weaknesses are CWE-74 and CWE-94. The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, where high privileges are required, which is why the score is Medium. The record does not mark the CVE as in CISA KEV, and it does not state a fixed version.
How to check if you're exposed
Find your SuperSonic version. Check your deployment files or the version shown in the admin interface, and compare it with 0.9.8. If you built it from source, look at the tag or commit you deployed.
Then look at who can reach the database management screens. The vector says high privileges are required, so the question is how many accounts have admin rights and how those accounts are protected. List them and remove any that are not needed.
Check the network position as well. Can the SuperSonic server be reached from the internet? Can it connect out to arbitrary hosts? An H2 connection URL that points at a remote script needs an outbound connection from the server, so egress rules matter.
Last, open the project's issue 2193 and release notes to see whether the maintainers have posted a fix, since the record does not list one.
What to do now
- Check the project's issue tracker and releases for a fixed version and upgrade when one is available.
- Restrict the admin interface to trusted networks and require strong, unique credentials with multi factor authentication where you can.
- Reduce admin accounts to the people who need them.
- Block outbound connections from the SuperSonic host except to the systems it must reach.
- If you maintain a fork, validate the JDBC URL against an allowlist before using it, and refuse the parameters that run scripts.
Why it matters
The test connection button is a common feature in data tools, and a common source of bugs. It takes a connection string typed by a user and hands it to a database driver. If the driver supports options that load files or run scripts, then the connection string is a program, not just an address. H2 is one such database. The weakness is CWE-74: input is used to build something that is then interpreted, without neutralizing the special parts.
The Medium rating reflects that only an administrator can use the screen. That does not make it harmless. Admin credentials leak, and tools like this often run with access to production data sources. The fix pattern is to allow only a short list of connection URL shapes, and to keep the server's outbound access narrow so even a bad URL has nowhere to go.
Quick check
Does an attacker need to be logged in?
The vector lists privileges required as High, which points to an administrator. The record does not give more detail, so protect admin accounts.
Is there a patch?
The record lists versions up to 0.9.8 as affected and names no fixed version. Check the project's issue and release pages.
Sources
Last reviewed: 19 October 2026.
