Vast-SQLi: Constraint-Guided AST Mutation for WAF-Evasive SQL Injection Payload Generation

Summary

Vast-SQLi is a framework that generates SQL injection test payloads through structure-aware rewrites of customized abstract syntax trees, rather than token-level edits under fixed rules. Large language models are fine-tuned on transformation traces and then refined with reinforcement learning using constraint-guided objectives. On eight representative WAFs, the method improves bypass success by 27.43% over raw inputs and surpasses state-of-the-art methods.

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
• MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database