ByteDance coze-studio EUVD-2026-25698

Exploitation requires authenticated access to ByteDance coze-studio with at least low-privilege user credentials (PR:L in CVSS). The databaseTool component and ExecuteSQL function must be accessible and enabled in the backend service. The vulnerability is triggered by submitting crafted SQL metacharacters or full SQL statements through input fields or parameters that are passed to the ExecuteSQL function without sanitization. No special configuration or non-default setup is explicitly required; default installations with authentication enabled are vulnerable. The limiting factors are the requirement for valid user credentials and network access to the coze-studio backend service.

This vulnerability presents moderate real-world risk despite a CVSS score of 5.3. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates remote exploitation requiring only low-privilege authentication with no user interaction, making it accessible to low-privileged application users or accounts. The CVSS v4.0 score reflects limited impact (VC:L/VI:L/VA:L - confidentiality, integrity, and availability each score low), suggesting the SQL injection does not grant complete database compromise but rather limited data access or modification. However, exploitation probability (E:P) is marked as probable, and public exploit code exists on GitHub, significantly elevating practical risk. The low authentication barrier (PR:L rather than PR:N) is the primary limiting factor - only authenticated users can trigger the vulnerability, which reduces attack surface compared to unauthenticated SQL injection. The absence of vendor response and continued presence of the flaw in versions through 0.5.1 indicate remediation is not underway. Organizations running coze-studio must assess whether low-privilege users are trusted or whether account compromise is a realistic threat model in their environment.

An authenticated user with low-privilege access to ByteDance coze-studio (such as a junior analyst or contractor account) crafts a malicious SQL injection payload and submits it through the databaseTool component's ExecuteSQL function via a network request. The backend service fails to sanitize the input, directly concatenating the user-supplied string into a SQL query. The attacker executes unauthorized SELECT or UPDATE queries against the backend database, exfiltrating sensitive data or modifying records. Given the low impact rating, the attacker likely gains access to unauthorized data or limited database modification rather than complete system compromise.