SQLBot, an intelligent Text-to-SQL system, permits prompt injection in its chat interface. The question supplied by the user is concatenated directly into the language‑model prompt without any filtering or escaping. The textual SQL the model outputs is then executed against the underlying database without validation. This flaw (CWE-89) enables an authenticated attacker to create a malicious query that can lead to remote code execution, particularly when the target is a PostgreSQL data source through the COPY FROM PROGRAM capability.

Dataease SQLBot versions 1.7.0 and earlier are impacted. The vulnerability is tied to PostgreSQL connections, where arbitrary SQL execution can be leveraged for code execution. Versions 1.7.1 and later contain the fix.

The CVSS score of 9.4 indicates critical severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an authenticated user submitting a specially crafted question to the Text2SQL interface, which is then processed by the LLM and executed as SQL on the backend database.