Executive brief
SQLBot is a text-to-SQL system that converts natural language queries into database operations. A vulnerability in the previewData API endpoint allows authenticated users to inject SQL code that bypasses read-only protections and execute dangerous PostgreSQL functions, potentially exposing sensitive files like configuration files, credentials, and source code stored on the server.
Technical details
This is a SQL injection vulnerability in the POST /api/v1/datasource/previewData endpoint (backend/apps/datasource/crud/datasource.py). The vulnerability exists because client-supplied table_name values are concatenated directly into SQL queries without proper identifier escaping or parameterization. An authenticated user can craft a malicious table_name to invoke dangerous PostgreSQL functions such as pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). These functions remain classified as SELECT operations under the read-only policy but execute with superuser privileges when used against the internal PostgreSQL service, particularly when authentication relies on trusted loopback connections that accept invalid credentials. An attacker with valid authentication can retrieve arbitrary filesystem content and expose sensitive data. The vulnerability was patched in version 1.9.0.
Affected products
- DataEase SQLBot prior to 1.9.0
Timeline
- 2026-09-17: disclosed
- 2026-06-03: patched: Fixed in version 1.9.0