# CVE-2026-33324: dataease SQLBot prompt injection in Text2SQL chat interface

Source: https://junglewise.ai/threats/cve-2026-33324-dataease-sqlbot-prompt-injection-in-text2sql-chat-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33324 · Severity: high · CVSS 8.8 · Published 2026-05-05

SQLBot, an AI-powered tool that converts natural language questions into database queries, is vulnerable to a flaw where users can manipulate the underlying AI. By sending specially crafted messages, an authorized user can trick the system into running unauthorized commands on the database server. This could allow an attacker to steal sensitive data, delete information, or even take full control of the server hosting the database.

Technologies: [DataEase SQLBot](https://junglewise.ai/threats/technologies/sqlbot). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-33324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33324 being exploited in the wild.

**How severe is CVE-2026-33324?** High severity, with a CVSS score of 8.8, published 5 May 2026.

**Which products and versions are affected?** DataEase SQLBot <= 1.7.0.

**Is there a fix for CVE-2026-33324?** A patch was published on 2026-05-05: Fix released in version 1.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33324 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33324?** Check whether you run DataEase SQLBot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A prompt injection vulnerability exists in the Text2SQL chat interface of SQLBot due to improper neutralization of user input. The 'question' parameter is directly concatenated into the LLM system and user prompts without filtering. An authenticated attacker can use malicious payloads to override system instructions, forcing the LLM to return arbitrary SQL. Because the application executes the LLM-generated SQL without validation or sanitization, this leads to SQL injection. When connected to a PostgreSQL backend, attackers can leverage the 'COPY FROM PROGRAM' command to achieve remote code execution (RCE). The issue is fixed in version 1.7.1.

## Affected products

- dataease SQLBot <= 1.7.0

## Timeline

- 2026-04-30: advisory: Vendor advisory published on GitHub
- 2026-05-05: disclosed: CVE published to NVD
- 2026-05-05: patched: Fix released in version 1.7.1

## References

- [https://github.com/dataease/SQLBot/security/advisories/GHSA-q2q6-gqqh-4xrx](https://github.com/dataease/SQLBot/security/advisories/GHSA-q2q6-gqqh-4xrx)

## Related threats

- [DataEase SQLBot second-order SQL injection in datasource deletion](https://junglewise.ai/threats/cve-2026-53557-dataease-sqlbot-second-order-sql-injection-in-datasource-deletion)
- [DataEase SQLBot SQL injection in previewData endpoint](https://junglewise.ai/threats/cve-2026-53556-dataease-sqlbot-sql-injection-in-previewdata-endpoint)
- [DataEase SQLBot stored cross-site scripting in assistant UI logo upload](https://junglewise.ai/threats/cve-2026-53555-dataease-sqlbot-stored-cross-site-scripting-in-assistant-ui-logo)
- [DataEase SQLBot arbitrary code execution in parseExcel](https://junglewise.ai/threats/cve-2026-53554-dataease-sqlbot-arbitrary-code-execution-in-parseexcel)
- [DataEase SQLBot IDOR and Authorization Bypass in Datasource Endpoints](https://junglewise.ai/threats/cve-2026-42463-dataease-sqlbot-idor-and-authorization-bypass-in-datasource)