CVE-2026-33324: SQLBot prompt injection allows arbitrary SQL execution and remote code execution

Vulnerability summary

CVE-2026-33324 is a critical (CVSS 9.4) vulnerability in dataease sqlbot. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-05-2026
   PublishedVulnerability first disclosed.
2. 05-05-2026
   Last modifiedVulnerability information updated.

Description

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to prompt injection. The user-provided question parameter is directly concatenated into the LLM prompt without filtering or escaping, and the SQL extracted from the LLM response is executed against the database without validation or sanitization. An authenticated attacker can craft a malicious question to manipulate the LLM into generating and executing arbitrary SQL statements. When connected to a PostgreSQL data source, this can lead to remote code execution via COPY FROM PROGRAM. This issue has been fixed in version 1.7.1.

• CWE-89Improper Neutralization of Special Elements used in an SQL CommandThe product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.