Executive brief
R2R is a framework for building retrieval-augmented generation (RAG) applications. An unauthenticated attacker can exploit a SQL injection vulnerability in the vector index creation endpoint to execute arbitrary database commands, including reading, modifying, or deleting data, with no authorization checks required.
Technical details
R2R contains a stacked SQL injection vulnerability (CWE-89) in the vector index creation endpoint (/v3/indices POST) where the index name parameter is interpolated directly into a CREATE INDEX SQL statement via f-string formatting without identifier quoting or input validation. The vulnerable code constructs the SQL string without bound parameters and executes it via asyncpg's simple-query protocol, which allows multiple semicolon-separated SQL statements. On the default deployment with unauthenticated access enabled and the database role configured as PostgreSQL superuser, an unauthenticated attacker can execute arbitrary DDL and DML statements to read, write, or modify the entire database. The vulnerability requires network access to the vector index creation endpoint but no authentication or user interaction.
Affected products
- SciPhi-AI R2R through 3.6.6
Timeline
- 2026-09-01: disclosed
- 2026-09-03: advisory