CVE-2026-53557

SQLBot prior to version 1.8.0 contains a Cross-Workspace IDOR and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces.

SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.

SQLBot before version 1.9.0 contains a vulnerability in the POST /api/v1/datasource/previewData endpoint, where the client-controlled table_name value is incorporated into generated SQL without safe identifier handling. An authenticated user can configure a datasource for the internal PostgreSQL and submit a crafted table_name that remains a SELECT operation but invokes pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response, potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0.

SQLBot before version 1.9.0 allows an authenticated user to submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content. SQLBot later serves the file inline from the same application origin through GET /api/v1/system/assistant/picture/{filename}. When another user loads that generated resource, JavaScript embedded in the SVG executes in the SQLBot web application context, resulting in stored cross-site scripting with access to data and actions available to the victim's session. This issue is fixed in version 1.9.0.

In SQLBot prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint uses attacker-controlled multipart filename data to select where uploaded content is stored, writes content before validation completes, and can transform a double-extension filename into a Python source file. The file lands in alembic/versions/ and is imported on SQLBot startup.

SQLBot through 1.10.0 contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

SQLBot version 1.7.0 and earlier is vulnerable to prompt injection in the Text2SQL interface, where the user question parameter is directly concatenated into the LLM prompt and the extracted SQL is executed without validation, potentially leading to remote code execution via COPY FROM PROGRAM in PostgreSQL.