{"data":{"id":"87b73653-9aa6-4ac1-9cea-1a1cf99284a6","title":"CVE-2026-32622: SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a…","summary":"SQLBot, an LLM and RAG-based data query system, contains a stored prompt injection vulnerability in versions 1.5.0 and below. A missing permission check on the Excel upload API lets any authenticated user upload terminology with unsanitized payloads, which is injected into the LLM's system prompt without semantic fencing. An attacker can thereby steer the model into generating malicious PostgreSQL commands such as COPY ... TO PROGRAM, achieving remote code execution with postgres user privileges on the database or application server.","solution":"Fixed in v1.6.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32622","publishedAt":"2026-03-19T21:17:10.563Z","cveId":"CVE-2026-32622","cweIds":["CWE-20","CWE-74","CWE-77","CWE-862"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["prompt_injection","supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["SQLBot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"SQLBot stored prompt injection via Excel upload enables code execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00584,"epssCheckedAt":"2026-11-04T12:08:33.950Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T18:10:55.933Z","patchAvailable":null,"disclosureDate":"2026-03-19T21:17:10.563Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122","CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"rag","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010","AML.T0051"],"fixes":[]}}