CVE-2026-53556

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled table_name value into generated SQL without safe identifier handling. An authenticated user can configure a datasource for SQLBot's internal PostgreSQL service and submit a crafted table_name that remains a SELECT operation under the read-only policy while invoking pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default tested trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response and potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/dataease/SQLBot/commit/76b5176b0e394740fd07c0d1769c0c792e8cb3b4
https://github.com/dataease/SQLBot/pull/1156
https://github.com/dataease/SQLBot/releases/tag/v1.9.0
https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5
https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5

Configurations

No configuration.

History

18 Sep 2026, 20:17

Type	Values Removed	Values Added
References	~~() https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5 -~~	() https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5 -

17 Sep 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 22:17

Updated : 2026-09-23 17:17

NVD link : CVE-2026-53556

Mitre link : CVE-2026-53556

CVE.ORG link : CVE-2026-53556

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-53556", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53556", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T20:01:09.483952Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dataease", "product": "SQLBot", "versions": [{"status": "affected", "version": "< 1.9.0"}]}]}], "published": "2026-09-17T22:17:00.073", "references": [{"url": "https://github.com/dataease/SQLBot/commit/76b5176b0e394740fd07c0d1769c0c792e8cb3b4", "source": "security-advisories@github.com"}, {"url": "https://github.com/dataease/SQLBot/pull/1156", "source": "security-advisories@github.com"}, {"url": "https://github.com/dataease/SQLBot/releases/tag/v1.9.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5", "source": "security-advisories@github.com"}, {"url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-vwjq-5h4h-x8g5", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled table_name value into generated SQL without safe identifier handling. An authenticated user can configure a datasource for SQLBot's internal PostgreSQL service and submit a crafted table_name that remains a SELECT operation under the read-only policy while invoking pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default tested trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response and potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0."}], "lastModified": "2026-09-23T17:17:49.503", "sourceIdentifier": "security-advisories@github.com"}