Stored Cross-Site Scripting Vulnerability in SQLBot by Dataease
CVE-2026-53555

5.1MEDIUM

Key Information:

Vendor

Dataease

Status
Sqlbot
Vendor
CVE Published:
17 September 2026

What is CVE-2026-53555?

An authenticated user in SQLBot prior to version 1.9.0 can upload an SVG logo through the PATCH /api/v1/system/assistant/ui endpoint without proper sanitization. This vulnerability allows malicious JavaScript embedded in the uploaded SVG to execute when other users access the generated resource. As a result, attackers can exploit the application's context, gaining unauthorized access to the victim's session data and performing actions on behalf of the victim. This security flaw was mitigated in version 1.9.0.

Affected Version(s)

SQLBot < 1.9.0

References

https://github.com/dataease/SQLBot/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/dataease/SQLBot/pull/1160
x_refsource_MISC
https://github.com/dataease/SQLBot/commit/835eefcb39b5952...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.