ASQL-injection flaw exists in the NL2SQLTool component of crewai-tools v1.10.2rc1. The flaw arises because the sql_query parameter is forwarded directly to the database without proper sanitization, allowing an attacker to inject and execute arbitrary SQL statements. By exploiting this vulnerability, an adversary could read confidential data, modify or delete records, or otherwise disrupt the database, effectively compromising the integrity and confidentiality of the stored information.

The vulnerability is confined to the crewai-tools package, version 1.10.2rc1, and is only present in its NL2SQLTool module. No broader vendor scope is indicated, and the CNA data lists no additional affected products.

The CVSS score of 6.5 reflects a medium severity rating. The EPSS score of less than 1% indicates a low probability that this flaw will be actively exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote request that includes a crafted sql_query argument, typically delivered via an exposed API or web endpoint. Without remediation, a remote attacker could directly execute commands against the database, potentially leading to data exposure or service disruption.