Vulnerability · Published May 5, 2026 · Assigned by GitHub_M
CVE-2026-33324SQLBot prompt injection allows arbitrary SQL execution and remote code execution
Critical 9.4
In plain English
A critical-severity SQL injection in SQLBot from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to prompt injection. The user-provided question parameter is directly concatenated into the LLM prompt without filtering or escaping, and the SQL extracted from the LLM response is executed against the database without validation or sanitization. An authenticated attacker can craft a malicious question to manipulate the LLM into generating and executing arbitrary SQL statements. When connected to a PostgreSQL data source, this can lead to remote code execution via COPY FROM PROGRAM. This issue has been fixed in version 1.7.1.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/dataease/SQLBot/security/advisories/GHSA-q2q6-gqqh-4xrx x_refsource_CONFIRM