{"data":{"id":"931ea1e0-e2f1-4e02-85e7-4fdb5f08ea80","title":"CVE-2026-53554: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/dat","summary":"SQLBot, a system that converts natural language questions into database queries using AI and RAG (retrieval-augmented generation, where the AI pulls in external data), had a vulnerability before version 1.9.0 where attackers could upload files with misleading names that tricked the system into saving malicious Python code to a special folder. When SQLBot restarted or updated its database structure, it would accidentally run the attacker's code.","solution":"This issue is fixed in version 1.9.0. Upgrade SQLBot to version 1.9.0 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53554","publishedAt":"2026-09-17T22:16:59.770Z","cveId":"CVE-2026-53554","cweIds":["CWE-22"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["SQLBot"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-09-17T22:16:59.770Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"rag","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010"]}}