CVE-2026-84061

MediumCVSS 6.3

Published: 01/09/2026(UTC)Updated: 01/09/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

SQL injection vulnerability in zhongyu09 OpenChatBI up to 0.3.0. The function _validate_sql_safety in openchatbi/text2sql/generate_sql.py is affected by manipulation, allowing remote attack. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 and v1.0.0b1/main have an incomplete validator.

Risk Assessment

An attacker can remotely execute unauthorized SQL queries, potentially leading to data integrity compromise or information disclosure.

Recommendation

Update OpenChatBI to the latest version if available, or apply additional protections such as query parameterization and access restrictions.

Other vulnerabilities in OpenChatBI

CVE-2026-5586Medium
zhongyu09 openchatbi up to version 0.2.1 is vulnerable to SQL injection via the 'keywords' argument in the Multi-stage Text2SQL Workflow component. An attacker can remotely manipulate this argument, leading to unauthorized SQL queries. The exploit has been publicly disclosed.

Original NVD description (English source)

A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file openchatbi/text2sql/generate_sql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS