SQL Injection Vulnerability in SQLBot by Dataease
CVE-2026-53556
6MEDIUM
What is CVE-2026-53556?
An SQL injection vulnerability exists in SQLBot, a text-to-SQL system developed by Dataease. Before version 1.9.0, the system's backend API improperly handled client-controlled inputs, specifically the table_name variable within the POST /api/v1/datasource/previewData endpoint. This lack of safe identifier management allowed authenticated users to construct malicious SQL queries that could exploit the internal PostgreSQL database. Consequently, an attacker could leverage this weakness to read sensitive filesystem content, such as system configuration files, potentially compromising user credentials and application secrets. This issue has been addressed and resolved in version 1.9.0.
Affected Version(s)
SQLBot < 1.9.0