Executive brief
SQLBot, an AI-powered tool that converts natural language questions into database queries, is vulnerable to a flaw where users can manipulate the underlying AI. By sending specially crafted messages, an authorized user can trick the system into running unauthorized commands on the database server. This could allow an attacker to steal sensitive data, delete information, or even take full control of the server hosting the database.
Technical details
A prompt injection vulnerability exists in the Text2SQL chat interface of SQLBot due to improper neutralization of user input. The 'question' parameter is directly concatenated into the LLM system and user prompts without filtering. An authenticated attacker can use malicious payloads to override system instructions, forcing the LLM to return arbitrary SQL. Because the application executes the LLM-generated SQL without validation or sanitization, this leads to SQL injection. When connected to a PostgreSQL backend, attackers can leverage the 'COPY FROM PROGRAM' command to achieve remote code execution (RCE). The issue is fixed in version 1.7.1.
Affected products
- dataease SQLBot <= 1.7.0
Timeline
- 2026-04-30: advisory: Vendor advisory published on GitHub
- 2026-05-05: disclosed: CVE published to NVD
- 2026-05-05: patched: Fix released in version 1.7.1