CVE-2026-53554: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/dat

SQLBot, a system that converts natural language questions into database queries using AI and RAG (retrieval-augmented generation, where the AI pulls in external data), had a vulnerability before version 1.9.0 where attackers could upload files with misleading names that tricked the system into saving malicious Python code to a special folder. When SQLBot restarted or updated its database structure, it would accidentally run the attacker's code.