Skip to content
OpenAdvisories

Product · dataease

SQLbot

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.4
    CVE-2026-33324

    SQLBot prompt injection allows arbitrary SQL execution and remote code execution

    SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to prompt injection. The user-provided question parameter is directly concatenated into the LLM prompt…

    dataease SQLbot