Is there a public PoC exploit available for EUVD-2026-19125?

Yes, a public proof-of-concept exploit is available for EUVD-2026-19125. Prioritise patching immediately. EPSS: 0.0%.

Griptape EUVD-2026-19125

Q: What is the CVSS score of EUVD-2026-19125?

EUVD-2026-19125 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5596 LOW

SQL Injection (CWE-89)

2026-04-05 VulDB

GHSA-pwwp-m5v6-r3p7

SQLi Griptape Griptape Ai

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 21:00 euvd

EUVD-2026-19125

Analysis Generated

Apr 05, 2026 - 21:00 vuln.today

CVE Published

Apr 05, 2026 - 20:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools/sql/tool.py of the component SqlTool. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in griptape-ai griptape 0.19.4 SqlTool allows authenticated remote attackers to manipulate SQL queries via the griptape/tools/sql/tool.py component, potentially accessing or modifying database contents. The exploit is publicly available, and the vendor has not responded to early disclosure notification.

Technical ContextAI

The vulnerability exists in the SqlTool component of griptape, a Python framework for building AI applications. The root cause is improper input validation and parameterization in SQL query construction (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The affected component is located in griptape/tools/sql/tool.py, which likely constructs dynamic SQL queries without adequate escaping or prepared statement usage. Attackers can inject arbitrary SQL commands through user-controlled input that is concatenated into SQL statements without sanitization.

RemediationAI

Immediate action: upgrade griptape to a version released after 0.19.4 that includes SQL injection mitigations. Contact griptape-ai directly or monitor their GitHub repository (https://github.com/griptape-ai/griptape) for patched releases, as the vendor has not formally published a security advisory. As a temporary workaround, restrict access to the SqlTool component to trusted administrators only, implement database access controls to limit query scope, and enable SQL query logging and monitoring to detect injection attempts. Users should review griptape release notes and security advisories at https://vuldb.com/vuln/355390 for vendor-provided remediation guidance.