CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53557

SQLBot , an intelligent Text-to-SQL system built on LLMs and RAG, contains a second-order SQL injection in its Excel datasource handling. Prior to 1.9.0 , an authenticated user can supply a crafted sheet["tableName"] value via POST /api/v1/datasource/, which is stored without safe identifier hand...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...