CVE-2026-5596
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
SQL Injection vulnerability in griptape 0.19.4. An unknown functionality in the file griptape/tools/sql/tool.py in the SqlTool component allows manipulation leading to SQL injection. The attack can be performed remotely, and the exploit is publicly available. The vendor did not respond.
Risk Assessment
An attacker can remotely execute arbitrary SQL queries on the database used by griptape, potentially leading to data leakage or modification.
Recommendation
Temporarily disable the SqlTool component or apply a workaround, such as input validation, until an official patch is released by the vendor.
Original NVD description (English source)
A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools/sql/tool.py of the component SqlTool. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.