Dataease Sqlbot
15 CVEs affecting Dataease Sqlbot. Latest disclosed: 2026-09-18. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33324 | High | 8.8 | 2026-05-05 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to… |
CVE-2026-32950 | High | 8.8 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in t… |
CVE-2026-32622 | High | 8.8 | 2026-03-19 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability th… |
CVE-2026-42463 | High | 8.1 | 2026-05-13 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Obj… |
CVE-2026-32949 | High | 7.5 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-93660 | Medium | 6.5 | 2026-09-18 | SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify ot… |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |
CVE-2025-69285 | Medium | 6.1 | 2026-01-21 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in t… |
CVE-2026-72743 | Medium | 5.4 | 2026-08-10 | SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE out… |
CVE-2026-5417 | Medium | 4.7 | 2026-04-02 | A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of… |
CVE-2025-15598 | Low | 3.7 | 2026-03-03 | A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the… |
CVE-2026-53557 | | 2026-09-17 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName… | |
CVE-2026-53556 | | 2026-09-17 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend… | |
CVE-2026-53555 | | 2026-09-17 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assis… | |
CVE-2026-53554 | | 2026-09-17 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/… |