CVE-2026-5586
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
zhongyu09 openchatbi up to version 0.2.1 is vulnerable to SQL injection via the 'keywords' argument in the Multi-stage Text2SQL Workflow component. An attacker can remotely manipulate this argument, leading to unauthorized SQL queries. The exploit has been publicly disclosed.
Risk Assessment
An attacker can gain unauthorized access to the database, including sensitive data, and potentially take control of the application. Public disclosure of the exploit increases the risk of attack.
Recommendation
Immediately update openchatbi to the latest available version or apply temporary mitigations such as input validation and parameterized SQL queries for the 'keywords' argument.
Original NVD description (English source)
A vulnerability was determined in zhongyu09 openchatbi up to 0.2.1. The impacted element is an unknown function of the component Multi-stage Text2SQL Workflow. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.