Executive brief
OpenChatBI is a tool that converts natural language queries to SQL. A flaw in its SQL safety validator allows attackers to bypass protections and inject malicious SQL commands, potentially exposing or modifying database contents. The vulnerability can be exploited remotely without authentication.
Technical details
The vulnerability is a SQL injection flaw in the _validate_sql_safety function of openchatbi/text2sql/generate_sql.py. Versions 0.2.0-0.2.2 lack SQL safety validation entirely, while 0.3.0 introduced an incomplete validator that can be bypassed. The attack vector is network-based with no authentication required. An attacker can manipulate the function to execute arbitrary SQL commands against the underlying database, leading to data exfiltration, modification, or deletion. The vendor has not responded to disclosure attempts.
Affected products
- zhongyu09 OpenChatBI up to 0.3.0
Timeline
- 2026-09-01: disclosed