Executive brief
SQLBot is a text-to-SQL system that converts natural language queries to database commands using AI. An authenticated attacker can craft a malicious Excel datasource name that, when the datasource is later deleted, executes arbitrary operating system commands on the server with PostgreSQL process privileges. This could lead to complete server compromise and unauthorized access to sensitive data or systems.
Technical details
The vulnerability is a second-order SQL injection in the datasource management API. An authenticated user submits a crafted sheet["tableName"] value through POST /api/v1/datasource/ with an Excel datasource configuration; SQLBot stores this value without proper identifier escaping. When the datasource is deleted via DELETE /api/v1/datasource/{id}, the stored value is interpolated directly into cleanup SQL and executed by PostgreSQL. The attacker can exploit PostgreSQL's COPY TO PROGRAM command to execute arbitrary OS commands as the postgres process. Authentication is required to trigger the initial payload storage, but the exploitation occurs server-side during deletion. This issue was fixed in version 1.9.0 by implementing proper identifier sanitization.
Affected products
- DataEase SQLBot prior to 1.9.0
Timeline
- 2026-09-17: disclosed
- 2026-09-06: patched: Version 1.9.0 released with fix