SQL Injection Vulnerability in SQLBot Product by Dataease

CVE-2026-33324

What is CVE-2026-33324?

SQLBot, a sophisticated Text-to-SQL system developed by Dataease, is exposed to a prompt injection vulnerability in versions 1.7.0 and earlier. The flaw arises as user-sent queries are integrated directly into the LLM (Large Language Model) prompt without adequate filtering, enabling an authenticated attacker to create malicious prompts that induce the LLM to generate harmful SQL commands. Once executed against a connected PostgreSQL database, this can lead to serious outcomes, including remote code execution, particularly through features such as COPY FROM PROGRAM. This vulnerability has been addressed in version 1.7.1.

References