Vulnerability · Published Sep 1, 2026 · Assigned by VulDB

CVE-2026-84061zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in OpenChatBI from zhongyu09. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 75.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file openchatbi/text2sql/generate_sql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
zhongyu09	OpenChatBI	0.10.20.3.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References

VDB-397552 | zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection vdb-entry, technical-description
VDB-397552 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-84061 | CVE Analysis and Report third-party-advisory
Submit #880544 | zhongyu09 OpenChatBI 1.0 SQL Injection third-party-advisory