A SQL injection flaw exists in the NL2SQLTool of crewai-tools v1.10.2rc1. The flaw arises because the sql_query parameter is passed directly to the database without proper sanitization, enabling a malicious actor to inject arbitrary SQL statements. An attacker exploiting this could trigger database queries that read, modify or delete data, effectively achieving remote code execution at the database level. The weakness corresponds to CWE-89.

The vulnerability is present only in crewai-tools v1.10.2rc1, specifically the NL2SQLTool component. No broader vendor scope is indicated.

Although no EPSS score or KEV designation exists, the lack of these metrics does not negate the seriousness of a remote SQL injection. The description shows the exploit requires a remote request that includes a crafted sql_query, suggesting a typical API attack vector. Without a patch or known workaround, the risk is that a remote attacker could compromise the underlying database and gain unauthorized data access or control. The CVSS score is not provided, so the precise severity calculation cannot be supplied here.