EUVD-2026-14262
GHSA-3p66-hvjq-gcvr
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS v3.1 base score of 5.3 is moderate (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), multiple factors elevate real-world risk substantially. The attack vector is local and requires low privilege (PR:L), but these are frequently achievable in multi-tenant SaaS or shared development environments. The public availability of a proof-of-concept exploit significantly increases exploitation probability beyond typical EPSS estimates. The vendor's non-response to early disclosure indicates no patch is forthcoming, eliminating the primary remediation path. SQL injection with confirmed impact on confidentiality, integrity, and availability (even if scoped to a single user/connection) poses material risk in any database-connected application. The automatable nature of SQL injection attacks (no user interaction required post-exploitation) and the presence of public exploit code elevate this from a theoretical vulnerability to an actionable threat. Organizations running Aix-DB in any production context should treat this as requiring urgent mitigation despite the moderate base score. |
| Exploit ScenarioDerived | An authenticated user with local access to a system running Aix-DB submits a malicious Description string containing SQL metacharacters (e.g., a single quote followed by UNION SELECT or DROP TABLE statements) through the terminology_retriever interface. Because the input is not properly parameterized, the injected SQL is concatenated directly into the query executed by the database backend. The attacker can extract sensitive data from the database, modify records, or execute administrative commands depending on the database user's privileges. Public proof-of-concept code available on GitHub (Ka7arotto/cve repository) demonstrates the exact syntax and payload construction, making this attack reproducible without deep SQL injection expertise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 21, 2026
SQL injection in apconw Aix-DB through the terminology_retriever.py module allows local attackers to manipulate the Description argument and execute arbitrary SQL commands. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. Affected versions include Aix-DB up to 1.2.3.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in apconw Aix-DB up to version 1.2.3, specifically in the terminology_retriever.py file within the agent/text2sql/rag module. An authenticated local attacker can manipulate the Description argument to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to early disclosure notifications, increasing real-world risk despite the moderate CVSS score of 5.3.
RemediationAI
Immediate action: upgrade to any version of apconw Aix-DB released after 1.2.3 if available; however, given the vendor's non-responsiveness, verify any upgrade with apconw directly or review GitHub/security advisory channels. Primary workaround pending patch availability: implement input validation and sanitization at the application layer before passing any user-supplied Description parameters to the terminology_retriever module—specifically, enforce parameterized query construction and reject or escape SQL metacharacters. Network segmentation is critical: restrict local access to the Aix-DB instance to trusted processes and users only, leveraging OS-level access controls and database authentication enforcement. Consider disabling or isolating the text2sql/RAG functionality if it is not essential to your workload. Monitor database logs and query patterns for signs of SQL injection attempts. Until the vendor releases a patch or an alternative is found, treat Aix-DB as high-risk in any security-sensitive context and prioritize migration to a maintained alternative if possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection flaw. The affected product is apconw Aix-DB (CPE: cpe:2.3:a:apconw:aix-db:*:*:*:*:*:*:*:*), a database abstraction or query generation tool that includes a natural language-to-SQL conversion module (text2sql). The terminology_retriever.py component within the RAG (Retrieval-Augmented Generation) pipeline fails to properly sanitize or parameterize user-supplied Description input before incorporating it into SQL queries. This allows an attacker to break out of intended query context and execute arbitrary SQL operations. The vulnerability affects all versions up to and including 1.2.3, suggesting no patched version has been released or publicly disclosed.
Know when Aix Db gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in apconw Aix-DB up to 1.2.3. This impacts an unknown function of the file agent/text2sql/rag/terminology_retriever.py. Performing a manipulation of the argument Description results in sql injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using apconw Aix-DB should be aware of moderate risk from CVE-2026-4530, a SQL injection vulnerability rated CVSS 5.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Aix-DB 1.2.4 ships a ChatBI 'common agent' that exposes the deepagents execute tool without any gating, letting any auth
Unauthenticated SQL data exfiltration in Aix-DB versions up to and including 1.2.4 allows attackers on adjacent networks
Stored cross-site scripting in Aix-DB through version 1.2.4 allows authenticated low-privilege users to inject persisten
Exploit-DB