Which versions of SQLBot are affected by CVE-2026-33324?

SQLBot versions 1.7.0 and earlier contain a critical prompt injection vulnerability that allows authenticated users to execute arbitrary SQL commands and potentially achieve remote code execution on…. A patch is available.

How to fix or mitigate CVE-2026-33324?

Within 24 hours: Identify all systems running SQLBot 1.7.0 or earlier and assess their PostgreSQL connectivity and data sensitivity. Within 7 days: Apply vendor-released patch to SQLBot 1.7.1 on all affected instances and validate through testing. Within 30 days: Conduct audit of recent SQLBot query logs for signs of exploitation and review access controls to restrict SQLBot usage to necessary personnel only.

SQLBot CVE-2026-33324

Q: What is the CVSS score of CVE-2026-33324?

CVE-2026-33324 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-27446 CRITICAL

SQL Injection (CWE-89)

2026-05-05 GitHub_M

PostgreSQL SQLi RCE

9.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 22:00 vuln.today

Patch available

May 05, 2026 - 21:02 EUVD

CVSS changed

May 05, 2026 - 20:22 NVD

9.4 (CRITICAL)

DescriptionGitHub Advisory

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to prompt injection. The user-provided question parameter is directly concatenated into the LLM prompt without filtering or escaping, and the SQL extracted from the LLM response is executed against the database without validation or sanitization. An authenticated attacker can craft a malicious question to manipulate the LLM into generating and executing arbitrary SQL statements. When connected to a PostgreSQL data source, this can lead to remote code execution via COPY FROM PROGRAM. This issue has been fixed in version 1.7.1.

AnalysisAI

Prompt injection in SQLBot 1.7.0 and earlier allows authenticated attackers to execute arbitrary SQL statements through the Text2SQL chat interface, escalating to remote code execution when connected to PostgreSQL databases via COPY FROM PROGRAM. The vulnerability stems from unsanitized user input being directly concatenated into LLM prompts, with resulting SQL executed without validation. CVSS 9.4 (Critical) reflects network-based attack with low complexity requiring only low-privilege authentication. SSVC framework confirms proof-of-concept availability and total technical impact, though exploitation is not fully automatable. Vendor-released patch 1.7.1 addresses the issue.

Technical ContextAI

SQLBot is a Text-to-SQL system that uses large language models (LLMs) with Retrieval-Augmented Generation (RAG) to convert natural language queries into SQL. The vulnerability is rooted in CWE-89 (SQL Injection), but manifests through a modern attack vector: prompt injection against the underlying LLM. The application concatenates user-supplied question parameters directly into prompts sent to the LLM without input filtering or escaping. The LLM-generated SQL is then extracted from the response and executed against the connected database without validation or parameterization. When the backend database is PostgreSQL, attackers can leverage PostgreSQL's COPY FROM PROGRAM command to execute operating system commands, bridging SQL injection to remote code execution. The CPE identifier cpe:2.3:a:dataease:sqlbot indicates this is a DataEase product, combining traditional SQL injection weaknesses with AI/LLM-specific attack surfaces.

RemediationAI

Upgrade to SQLBot version 1.7.1 immediately, which contains vendor-released patches addressing both the prompt injection and SQL injection vulnerabilities. The fix is available from the official GitHub repository at https://github.com/dataease/SQLBot with details in security advisory GHSA-q2q6-gqqh-4xrx. For environments unable to upgrade immediately, implement the following compensating controls with noted limitations: restrict access to the Text2SQL chat interface to only trusted users through application-level access controls (reduces attack surface but does not eliminate risk from insider threats or compromised accounts); deploy database-level restrictions preventing use of PostgreSQL COPY FROM PROGRAM and other command execution functions through role-based permissions (mitigates RCE escalation but does not prevent SQL injection or data exfiltration); implement network segmentation isolating database servers from internet-accessible resources (limits lateral movement post-compromise but does not prevent initial exploitation). Note that these workarounds significantly impact SQLBot functionality and do not address the root cause-version 1.7.1 upgrade is the only complete remediation.