Executive brief
OpenChatBI is an intelligent business intelligence tool that allows users to query and analyze data using natural language. A security vulnerability in its workflow allows an attacker to bypass safety filters and execute unauthorized database commands. This could lead to the theft of sensitive data, deletion of database tables, or even full control over the underlying database server.
Technical details
A SQL injection vulnerability exists in the Multi-stage Text2SQL Workflow of openchatbi through version 0.2.1. The root cause is a prompt injection flaw where malicious user input can manipulate the Large Language Model (LLM) nodes responsible for information extraction and schema linking. By crafting a specific prompt, an attacker can force the LLM to generate arbitrary SQL statements that bypass internal validation checks. These statements are subsequently executed against the connected database without sanitization. In certain environments, such as those using PostgreSQL, this can be escalated to Remote Code Execution (RCE) using commands like 'COPY FROM PROGRAM'. The exploit has been publicly disclosed.
Affected products
- zhongyu09 openchatbi up to 0.2.1
Timeline
- 2026-04-05: disclosed: Vulnerability disclosed via GitHub issue and VulDB
- 2026-04-05: advisory: CVE-2026-5586 published