Executive brief
R2R is an open-source platform for semantic search and retrieval-augmented generation. A SQL injection vulnerability in the retrieval search endpoint allows unauthenticated attackers to extract sensitive data from the application database by crafting malicious filter parameters, potentially exposing customer documents, metadata, and other stored information.
Technical details
This is a SQL injection vulnerability (CWE-89) in the chunks search query endpoint. The root cause is direct interpolation of client-supplied filter keys into the SQL WHERE clause without parameterization or escaping in py/core/providers/database/filters.py (_build_metadata_operator_condition function). An unauthenticated attacker can inject arbitrary SQL predicates via the filter key parameter in POST /v3/retrieval/search, exploiting the default configuration where require_authentication = false maps unauthenticated requests to the superuser account. Attack preconditions are minimal: the attacker needs network access to the retrieval search endpoint. Confirmed attacks include time-based and boolean-based data exfiltration from the r2r_default.chunks table, though stacked queries are blocked by asyncpg prepared statements. Patches are expected to bind JSON path segments as parameters or enforce allowlisting rather than raw string interpolation.
Affected products
- SciPhi-AI R2R through 3.6.6
Timeline
- 2026-09-01: disclosed
- 2026-09-03: advisory