EUVD-2026-13543Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryUpload malicious Excel file with SQL injection in sheet name
-
ExploitConcatenate unsanitized sheet name into PostgreSQL table creation
-
ExecutionExecute arbitrary SQL via COPY statement
-
ImpactAchieve remote code execution on backend server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user access to SQLBot versions <1.7.0 with /api/v1/datasource/uploadExcel endpoint accessible. Attacker uploads Excel file with malicious sheet names to inject SQL commands into PostgreSQL table creation and COPY statements, achieving remote code execution on backend server. |
| Impact | This vulnerability presents critical real-world risk despite requiring low-privilege authentication (PR:L). The CVSS 4.0 score of 8.6 reflects network accessibility (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), and no user interaction (UI:N), with high confidentiality and integrity impacts (VC:H/VI:H). The vulnerability is highly automatable once credentials are obtained, as it requires only crafting malicious Excel files and uploading them via a documented API endpoint. The confirmed impacts—arbitrary command execution, complete database compromise, and system file access—represent the highest technical impact tier in SSVC decision frameworks. The availability of detailed technical analysis in GitHub security advisory GHSA-7hww-8rj5-7rmm and a public commit showing the fix (39f2203cec4bb4b0aa541710733fe7608e3d3c48) significantly lowers the barrier for exploit development. Any organization running SQLBot in production with multiple authenticated users faces immediate risk of insider threats or compromised account abuse. The combination of RCE capability, low complexity, and detailed public disclosure makes this a genuine priority requiring urgent remediation regardless of the authentication requirement. |
| Exploit ScenarioDerived | An attacker with valid low-privilege credentials to the SQLBot application first uploads a benign Excel file containing shell commands in data rows, which gets imported into a PostgreSQL table. The attacker then crafts a second Excel file using XML manipulation to create a sheet name that injects SQL syntax, specifically a TO PROGRAM 'sh' clause that will cause PostgreSQL to pipe the previously uploaded command data to a shell. Upon upload via the /api/v1/datasource/uploadExcel API endpoint, the malicious sheet name is concatenated directly into the COPY statement, executing arbitrary commands as the postgres user and allowing the attacker to exfiltrate sensitive files, establish reverse shells, or compromise the entire database server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
SQLBot, an intelligent data query system based on large language models and RAG, contains a critical SQL injection vulnerability in the /api/v1/datasource/uploadExcel endpoint that allows authenticated users with minimal privileges to achieve remote code execution on the backend server. SQLBot versions prior to 1.7.0 are affected, and attackers can exploit unsafe concatenation of Excel sheet names into PostgreSQL table names and COPY statements to inject malicious SQL commands. The vulnerability enables arbitrary command execution as the postgres user, database takeover, and sensitive file exfiltration including /etc/passwd and /etc/shadow.
RemediationAI
Upgrade SQLBot to version 1.7.0 or later immediately, as documented in the release notes at https://github.com/dataease/SQLBot/releases/tag/v1.7.0. The fix implemented in commit 39f2203cec4bb4b0aa541710733fe7608e3d3c48 addresses the unsafe string concatenation by implementing proper input sanitization for Excel sheet names and replacing f-string SQL construction with parameterized queries. Until patching is completed, implement compensating controls including restricting access to the /api/v1/datasource/uploadExcel endpoint to only highly trusted administrators, implementing strict input validation on file uploads at the web application firewall or reverse proxy layer, and monitoring PostgreSQL logs for suspicious COPY TO PROGRAM statements. Organizations should audit existing uploaded Excel files for potential malicious sheet names and review postgres user command execution logs for signs of prior exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects SQLBot, a Python-based data query system that integrates large language models with Retrieval-Augmented Generation (RAG) for natural language database queries. The root cause maps to CWE-78 (OS Command Injection), stemming from two critical flaws in datasource.py: Excel sheet names are directly concatenated into PostgreSQL table names without sanitization at line 351, and these unsanitized table names are embedded into COPY SQL statements using Python f-strings rather than parameterized queries at lines 385-388. Attackers exploit PostgreSQL's COPY TO PROGRAM feature, which allows SQL statements to invoke shell commands, by uploading specially crafted Excel files with XML-tampered sheet names that inject a TO PROGRAM 'sh' clause. The two-stage attack bypasses the 31-character sheet name limit by first uploading normal data containing shell commands, then uploading a file whose sheet name completes the SQL injection payload.
Know when Sqlbot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in the /api/v1/datasource/uploadExcel endpoint that enables Remote Code Execution (RCE), allowing any authenticated user (even the lowest-privileged) to fully compromise the backend server. The root cause is twofold: Excel Sheet names are concatenated directly into PostgreSQL table names without sanitization (datasource.py#L351), and those table names are embedded into COPY SQL statements via f-strings instead of parameterized queries (datasource.py#L385-L388). An attacker can bypass the 31-character Sheet name limit using a two-stage technique-first uploading a normal file whose data rows contain shell commands, then uploading an XML-tampered file whose Sheet name injects a TO PROGRAM 'sh' clause into the SQL. Confirmed impacts include arbitrary command execution as the postgres user (uid=999), sensitive file exfiltration (e.g., /etc/passwd, /etc/shadow), and complete PostgreSQL database takeover. This issue has been fixed in version 1.7.0.
Executive ViewAI
SQLBot versions before 1.7.0 contain a SQL injection vulnerability in the Excel upload endpoint that allows authenticated users to execute arbitrary commands on the backend database server and potentially exfiltrate sensitive system files. This directly threatens data confidentiality, integrity, and system availability for any organization using SQLBot for data query operations, particularly where internal users have file upload capabilities.
Vendor-released patch: SQLBot 1.7.0 or later. If immediate upgrade is not feasible: implement network-level controls to restrict access to /api/v1/datasource/uploadExcel endpoint to authorized administrators only; disable Excel upload functionality entirely until patch deployment is completed; monitor database audit logs for suspicious COPY statements or table creation commands.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in SQLBot SSRF and SQL Injection
View all 2SQLBot is an intelligent data query system based on a large language model and RAG. [CVSS 6.1 MEDIUM]
Prompt injection in SQLBot 1.7.0 and earlier allows authenticated attackers to execute arbitrary SQL statements through
Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can e
Remote code execution in SQLBot 1.5.0 and below allows authenticated users to inject malicious prompts through unsanitiz
Cross-workspace IDOR in SQLBot (DataEase) versions prior to 1.8.0 allows authenticated low-privilege users to read and m
Authenticated workspace members in DataEase SQLBot through 1.10.1 can rename and rewrite other users' private dashboards
A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps
Server-side request forgery (SSRF) in Dataease SQLBot up to version 1.6.0 allows high-privileged remote attackers to man
Stored cross-site scripting in SQLBot prior to 1.9.0 lets an authenticated user with logo-upload privileges persist a ma
Exploit-DB