CVE-2026-4530: apconw Aix-DB SQL injection through terminology_retriever.py

Summary

CVE-2026-4530 is a flaw in apconw Aix-DB up to 1.2.3, in an unknown function of agent/text2sql/rag/terminology_retriever.py. Manipulating the Description argument leads to SQL injection, and the attack requires local access. A public exploit has been released, and the vendor did not respond to early disclosure.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-63651: LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect…Similar attack · NVD/CVE Database
• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• InfoLocation Matters: Sparse Latent-Variance Attacks for Face Privacy against Diffusion PersonalizationSimilar attack · Arxiv (cs.RO + cs.CV security)
• MediumCVE-2026-83953 GitHub Copilot for Jetbrains Information Disclosure VulnerabilitySimilar attack · MSRC Security Update Guide
• HighGHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU AttacksSimilar attack · GitHub Advisory Database