CVE-2026-53554
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In SQLBot prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint uses attacker-controlled multipart filename data to select where uploaded content is stored, writes content before validation completes, and can transform a double-extension filename into a Python source file. The file lands in alembic/versions/ and is imported on SQLBot startup.
Risk Assessment
An attacker can plant a malicious Python file that executes on SQLBot startup or migration, leading to remote code execution in the application context. This may result in full system takeover.
Recommendation
Upgrade SQLBot to version 1.9.0 or later. Verify the contents of the alembic/versions/ directory and restrict file uploads by unprivileged users.
Other vulnerabilities in SQLBot
See all- CVE-2026-42463High
SQLBot prior to version 1.8.0 contains a Cross-Workspace IDOR and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces.
- CVE-2026-93660Medium
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
- CVE-2026-53557High
In SQLBot prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration, which is stored without safe identifier handling. When the datasource is deleted, the value is interpolated into SQL and executed by PostgreSQL, enabling second-order SQL injection.
- CVE-2026-53556Medium
SQLBot before version 1.9.0 contains a vulnerability in the POST /api/v1/datasource/previewData endpoint, where the client-controlled table_name value is incorporated into generated SQL without safe identifier handling. An authenticated user can configure a datasource for the internal PostgreSQL and submit a crafted table_name that remains a SELECT operation but invokes pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response, potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0.
- CVE-2026-53555Medium
SQLBot before version 1.9.0 allows an authenticated user to submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content. SQLBot later serves the file inline from the same application origin through GET /api/v1/system/assistant/picture/{filename}. When another user loads that generated resource, JavaScript embedded in the SVG executes in the SQLBot web application context, resulting in stored cross-site scripting with access to data and actions available to the victim's session. This issue is fixed in version 1.9.0.
- CVE-2026-72743Medium
SQLBot through 1.10.0 contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.
- CVE-2026-33324High
SQLBot version 1.7.0 and earlier is vulnerable to prompt injection in the Text2SQL interface, where the user question parameter is directly concatenated into the LLM prompt and the extracted SQL is executed without validation, potentially leading to remote code execution via COPY FROM PROGRAM in PostgreSQL.
Original NVD description (English source)
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes the content before spreadsheet parsing and validation finish, and can transform a double-extension filename into a Python source file. An attacker able to submit a crafted multipart upload can use these behaviors to place attacker-controlled content in /opt/sqlbot/app/alembic/versions/ even when a spreadsheet parsing failure after the file write causes the endpoint to return an error. The planted file remains on disk, and subsequent SQLBot startup or migration processing causes Alembic to import the module and execute its module-level statements in the SQLBot application runtime. This issue is fixed in version 1.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS