CVE-2026-68549

### Impact A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-m` argument to escape the intended migrations directory. Under specific conditions, an attacker could cause the tool to create a `.sql` file in an arbitrary location writable by the user executing the command. This issue is only exploitable if an attacker can influence the migration name passed to the `revision` command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input. ### Patches The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal. Users should upgrade to version 1.0.3 or later. ### Workarounds Do not pass untrusted input to the `revision -m` argument. If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the `revision` command and that migration names are validated before being passed to the tool. ### References - Fix commit: https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6