---
id: CVE-2026-53557
title: >-
  SQLBot is an intelligent Text-to-SQL system based on large language models and
  RAG
summary: >-
  SQLBot is an intelligent Text-to-SQL system based on large language models and
  RAG. Prior to 1.9.0, an authenticated user can supply a crafted
  sheet["tableName"] value in the Excel datasource configuration submitted
  through POST /api/v1/…
severity: high
cvss: 7.7
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-89
vendor: dataease
product: SQLBot
affected:
  - SQLBot < 1.9.0
published: '2026-09-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:49.530'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53557'
references:
  - url: >-
      https://github.com/dataease/SQLBot/commit/5d5a92a5266e62da7de4a84ffc8317498497b193
    label: security-advisories@github.com
  - url: 'https://github.com/dataease/SQLBot/releases/tag/v1.9.0'
    label: security-advisories@github.com
  - url: 'https://github.com/dataease/SQLBot/security/advisories/GHSA-vxwj-843f-9c9g'
    label: security-advisories@github.com
  - url: 'https://github.com/dataease/SQLBot/security/advisories/GHSA-vxwj-843f-9c9g'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
epss: 0.00336
epssPercentile: 0.24312
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-22T01:53:38.445986Z'
cvssSource: cna
ingestedAt: '2026-09-17T22:30:21.399Z'
---

## Overview

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe identifier handling. When the same datasource is later removed through DELETE /api/v1/datasource/{id}, the stored value is interpolated into datasource cleanup SQL and executed by PostgreSQL. This second-order SQL injection can invoke PostgreSQL COPY TO PROGRAM and execute arbitrary operating-system commands with the privileges of the postgres process inside the SQLBot container. This issue is fixed in version 1.9.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.