CVE-2026-53556
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
SQLBot before version 1.9.0 contains a vulnerability in the POST /api/v1/datasource/previewData endpoint, where the client-controlled table_name value is incorporated into generated SQL without safe identifier handling. An authenticated user can configure a datasource for the internal PostgreSQL and submit a crafted table_name that remains a SELECT operation but invokes pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response, potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0.
Risk Assessment
The vulnerability allows an authenticated user to read sensitive files from the server, including configuration files, credentials, and secrets, which can lead to full system compromise and data leakage.
Recommendation
It is recommended to immediately upgrade SQLBot to version 1.9.0 or later, which includes the fix. Additionally, restrict access to the previewData endpoint and review the authentication configuration of the internal database.
Other vulnerabilities in SQLBot
See all- CVE-2026-42463High
SQLBot prior to version 1.8.0 contains a Cross-Workspace IDOR and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces.
- CVE-2026-93660Medium
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
- CVE-2026-53557High
In SQLBot prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration, which is stored without safe identifier handling. When the datasource is deleted, the value is interpolated into SQL and executed by PostgreSQL, enabling second-order SQL injection.
- CVE-2026-53555Medium
SQLBot before version 1.9.0 allows an authenticated user to submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content. SQLBot later serves the file inline from the same application origin through GET /api/v1/system/assistant/picture/{filename}. When another user loads that generated resource, JavaScript embedded in the SVG executes in the SQLBot web application context, resulting in stored cross-site scripting with access to data and actions available to the victim's session. This issue is fixed in version 1.9.0.
- CVE-2026-53554High
In SQLBot prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint uses attacker-controlled multipart filename data to select where uploaded content is stored, writes content before validation completes, and can transform a double-extension filename into a Python source file. The file lands in alembic/versions/ and is imported on SQLBot startup.
- CVE-2026-72743Medium
SQLBot through 1.10.0 contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.
- CVE-2026-33324High
SQLBot version 1.7.0 and earlier is vulnerable to prompt injection in the Text2SQL interface, where the user question parameter is directly concatenated into the LLM prompt and the extracted SQL is executed without validation, potentially leading to remote code execution via COPY FROM PROGRAM in PostgreSQL.
Original NVD description (English source)
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled table_name value into generated SQL without safe identifier handling. An authenticated user can configure a datasource for SQLBot's internal PostgreSQL service and submit a crafted table_name that remains a SELECT operation under the read-only policy while invoking pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default tested trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response and potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS