CVE-2026-53557: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated use

SQLBot is a system that converts natural language questions into SQL database queries using AI and RAG (retrieval-augmented generation, where the system pulls in external data to help answer questions). Before version 1.9.0, authenticated users could exploit a second-order SQL injection (a type of attack where malicious code is stored first, then executed later) by crafting a fake table name in an Excel configuration file, which would then run as dangerous commands when the datasource was deleted.