Quick answers
- Is CVE-2026-53556 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-53556 being exploited in the wild.
- How severe is CVE-2026-53556?
- Informational severity, with a CVSS score of 7.1, published 17 September 2026.
- Which products and versions are affected?
- DataEase SQLBot prior to 1.9.0.
- Is there a fix for CVE-2026-53556?
- A patch was published on 2026-06-03: Fixed in version 1.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-53556 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-53556?
- Check whether you run DataEase SQLBot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a SQL injection vulnerability in the POST /api/v1/datasource/previewData endpoint (backend/apps/datasource/crud/datasource.py). The vulnerability exists because client-supplied table_name values are concatenated directly into SQL queries without proper identifier escaping or parameterization. An authenticated user can craft a malicious table_name to invoke dangerous PostgreSQL functions such as pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). These functions remain classified as SELECT operations under the read-only policy but execute with superuser privileges when used against the internal PostgreSQL service, particularly when authentication relies on trusted loopback connections that accept invalid credentials. An attacker with valid authentication can retrieve arbitrary filesystem content and expose sensitive data. The vulnerability was patched in version 1.9.0.
Affected products
- DataEase SQLBot prior to 1.9.0
Timeline
- 2026-09-17: disclosed
- 2026-06-03: patched: Fixed in version 1.9.0