SQL Injection Vulnerability in llmware by Llmware.ai

CVE-2026-85689

What is CVE-2026-85689?

The llmware 0.4.6 version is susceptible to an SQL injection vulnerability due to improper handling of filter and lookup values within the database layer. The application directly interpolates these values into SQL WHERE clauses without applying proper parameterization or escaping, affecting both SQLite and PostgreSQL backends. The lack of value sanitization allows malicious actors to exploit the filter validation process, enabling them to neutralize the intended filter and access rows they are typically restricted from viewing. This risk of cross-document and cross-collection disclosure, particularly in PostgreSQL, may also facilitate advanced attack vectors such as boolean- and UNION-based SQL injection.

References