Onyx CVE-2025-7894

No vendor-released patch identified at time of analysis, as the vendor has not responded to early disclosure notification. Immediate remediation options are limited: upgrade to a version beyond 0.29.1 if released by the maintainers (verify release notes at https://github.com/OnyxProject or project repository), or implement input validation and output encoding mitigations at the application layer. Compensating controls include restricting Chat Interface access to trusted internal users only via network segmentation or authentication gateway (reduces attack surface from remote to internal-only, accepting reduced functionality), disabling the KB search feature if not essential to operations (eliminates attack vector entirely at cost of feature loss), and implementing database query result monitoring to detect anomalous SQL patterns (does not prevent exploitation but enables rapid incident response). Database-level mitigation: configure database accounts used by Onyx with minimal required privileges (read-only where feasible, no DDL permissions) to limit damage from successful injection, though this does not prevent data exfiltration. Recommend contacting Onyx maintainers directly to request patch priority given non-response to initial disclosure.