What is CVE-2026-84061?

CVE-2026-84061 is a medium-severity vulnerability in Zhongyu09 Openchatbi, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.3/10. Published 2026-09-01.

How severe is CVE-2026-84061?

Medium severity. CVSS v3 base score is 6.3 out of 10.

SQL Injection in Zhongyu09 Openchatbi

CVE-2026-84061

A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file openchatbi/text2sql/generate_sql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Zhongyu09 Openchatbi — versions 0.1, 0.2, 0.3.0

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-84061?: CVE-2026-84061 is a medium-severity vulnerability in Zhongyu09 Openchatbi, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.3/10. Published 2026-09-01.
How severe is CVE-2026-84061?: Medium severity. CVSS v3 base score is 6.3 out of 10.