CVE-2026-33324: SQLBot prompt injection in Text2SQL chat interface leading to SQL execution

Summary

SQLBot, a Text-to-SQL system built on large language models and RAG, is affected in versions 1.7.0 and earlier. Its Text2SQL chat interface concatenates the user-provided question directly into the LLM prompt without filtering, and executes the SQL extracted from the LLM response without validation. An authenticated attacker can craft a malicious question to make the LLM generate and run arbitrary SQL, which, when connected to a PostgreSQL data source, can lead to remote code execution via COPY FROM PROGRAM.

Mitigation

Fixed in 1.7.1.

Topics

• Retrieval-augmented generation

Related items

• LowCVE-2026-123498: Vikunja veans prompt injection through project titles and task contentSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
• InfoDecision Models as Retrieval Gates Against Injection and PollutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMultimodal-SEA: Benchmarking AI Agent Security under Multimodal Social Engineering AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)