EUVD-2026-13210Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any user
-
DeliveryUpload malicious Excel with crafted terminology
-
ExploitInject unsanitized payload into LLM system prompt
-
ExecutionLLM generates malicious PostgreSQL commands
-
ImpactExecute arbitrary code via COPY TO PROG
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | SQLBot versions 1.5.0 and below. Requires authenticated user access to upload Excel files via the terminology upload API. Attacker uploads malicious terminology with unsanitized descriptions containing LLM prompt injection payloads. No victim interaction needed beyond system use. |
| Impact | Complete system compromise — the attacker gains the ability to install malware, steal data, create backdoors, or pivot to other systems on the network. |
| Exploit ScenarioDerived | An attacker sends a specially crafted request to the vulnerable service that triggers code execution with the privileges of the running process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 19, 2026
Remote code execution in SQLBot 1.5.0 and below allows authenticated users to inject malicious prompts through unsanitized terminology uploads, enabling attackers to manipulate the LLM into generating arbitrary PostgreSQL commands executed with database privileges. The vulnerability stems from missing permission checks on the Excel upload API combined with inadequate semantic isolation when injecting user-controlled data into the system prompt. An attacker can exploit this to achieve code execution on the database or application server running as the postgres user.
Earlier versions of this analysis (1)
RemediationAI
Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Missing Authorization (CWE-862).
Know when Sqlbot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability that chains three flaws: a missing permission check on the Excel upload API allowing any authenticated user to upload malicious terminology, unsanitized storage of terminology descriptions containing dangerous payloads, and a lack of semantic fencing when injecting terminology into the LLM's system prompt. Together, these flaws allow an attacker to hijack the LLM's reasoning to generate malicious PostgreSQL commands (e.g., COPY ... TO PROGRAM), ultimately achieving Remote Code Execution on the database or application server with postgres user privileges. The issue is fixed in v1.6.0.
Executive ViewAI
SQLBot versions 1.5.0 and below contain a remote code execution vulnerability that allows authenticated users to execute arbitrary database commands by uploading malicious terminology files, potentially exposing sensitive data or disrupting database operations. Organizations running SQLBot must urgently upgrade to patch this vulnerability to prevent insider threats and compromised user accounts from gaining database-level command execution.
Apply vendor patch. Interim mitigations pending patch deployment: (1) Restrict terminology upload functionality to database administrators only via role-based access controls; (2) Implement network-level access controls limiting upload API requests to internal administrative networks; (3) Enable comprehensive audit logging of all Excel file uploads with content inspection; (4) Isolate SQLBot database accounts to read-only permissions where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
SQLBot is an intelligent data query system based on a large language model and RAG. [CVSS 6.1 MEDIUM]
Prompt injection in SQLBot 1.7.0 and earlier allows authenticated attackers to execute arbitrary SQL statements through
Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can e
SQLBot, an intelligent data query system based on large language models and RAG, contains a critical SQL injection vulne
Cross-workspace IDOR in SQLBot (DataEase) versions prior to 1.8.0 allows authenticated low-privilege users to read and m
A Server-Side Request Forgery (SSRF) vulnerability in SQLBot, an intelligent data query system based on large language m
Authenticated workspace members in DataEase SQLBot through 1.10.1 can rename and rewrite other users' private dashboards
A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps
Server-side request forgery (SSRF) in Dataease SQLBot up to version 1.6.0 allows high-privileged remote attackers to man
Stored cross-site scripting in SQLBot prior to 1.9.0 lets an authenticated user with logo-upload privileges persist a ma
Exploit-DB