Retrieval-augmented generation

SQLBot, an LLM and RAG-based data query system, contains a SQL injection flaw in the /api/v1/datasource/uploadExcel endpoint in versions prior to 1.7.0. Excel sheet names are concatenated into PostgreSQL table names and embedded in COPY statements via f-strings, so any authenticated user, even the lowest-privileged, can reach remote code execution through a two-stage upload that bypasses the 31-character sheet name limit. Confirmed impacts include command execution as the postgres user, exfiltration of files such as /etc/passwd and /etc/shadow, and full database takeover.

SQLBot, an LLM and RAG-based data query system, contains a stored prompt injection vulnerability in versions 1.5.0 and below. A missing permission check on the Excel upload API lets any authenticated user upload terminology with unsanitized payloads, which is injected into the LLM's system prompt without semantic fencing. An attacker can thereby steer the model into generating malicious PostgreSQL commands such as COPY ... TO PROGRAM, achieving remote code execution with postgres user privileges on the database or application server.

Milvus versions prior to 2.5.27 and 2.6.10 expose TCP port 9091 by default, enabling authentication bypasses. The /expr debug endpoint uses a weak, predictable default token derived from etcd.rootPath (default: by-dev), allowing arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without authentication, giving unauthenticated access to all business operations, including data manipulation and credential management.

Milvus versions prior to 2.4.24, 2.5.21, and 2.6.5 contain a flaw that lets an unauthenticated attacker bypass all authentication in the Milvus Proxy component. A successful attacker gains full administrative access to the Milvus cluster, with the ability to read, modify, or delete data and perform privileged operations such as database or collection management.