EUVD-2026-19117

| CVE-2026-5586 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-05 cna@vuldb.com

SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 05, 2026 - 18:22 euvd

EUVD-2026-19117

Analysis Generated

Apr 05, 2026 - 18:22 vuln.today

CVE Published

Apr 05, 2026 - 18:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in zhongyu09 openchatbi up to 0.2.1. The impacted element is an unknown function of the component Multi-stage Text2SQL Workflow. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in zhongyu09 openchatbi up to version 0.2.1 allows authenticated remote attackers to manipulate the keywords argument in the Multi-stage Text2SQL Workflow component, leading to unauthorized database access with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.

Technical ContextAI

The vulnerability resides in the Multi-stage Text2SQL Workflow component of openchatbi, a tool that translates natural language text to SQL queries. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating insufficient input validation or sanitization of the keywords parameter before its use in SQL query construction. When user-supplied keywords are passed to the Text2SQL pipeline without proper parameterization or escaping, an attacker can inject arbitrary SQL syntax that alters query logic, potentially exposing sensitive data or modifying database state. The vulnerability affects openchatbi versions through 0.2.1.

RemediationAI

Upgrade zhongyu09 openchatbi to a patched version beyond 0.2.1 as soon as available. However, no specific patched version release has been confirmed in the provided data; vendors are advised to apply input validation and parameterized SQL query construction to the Multi-stage Text2SQL Workflow keywords parameter immediately. In the interim, implement strict SQL allowlist validation for keywords input, enforce principle of least privilege on database credentials used by openchatbi, restrict access to the Text2SQL component to trusted users only, and conduct code review of the keywords processing logic. Reference the vulnerability disclosure at https://github.com/Ka7arotto/cve/blob/main/openchatbi-SQL/issue.md and VulDB record https://vuldb.com/vuln/355385 for additional technical details.