The vulnerability resides in an unspecified function of the Multi‑stage Text2SQL Workflow component of zhongyu09 openchatbi, affecting versions up to 0.2.1. Manipulating the arguments supplied to this function can inject arbitrary SQL statements into database queries. Successful exploitation can result in unauthorized reading, modification, or deletion of database contents, compromising the confidentiality, integrity, and availability of stored data. The attack may be launched remotely and has been publicly disclosed.

The flaw affects all installations of zhongyu09 openchatbi with versions up to and including 0.2.1. No specific vulnerable sub‑components are listed beyond the unnamed function referenced in the description.

The CVSS score of 5.3 represents a moderate severity vulnerability that does not directly lead to system compromise but allows data exfiltration or alteration. The EPSS score of < 1% indicates a very low probability of exploitation, though the exploit has been publicly disclosed and could be deployed remotely if the vulnerability remains unpatched. The vendor has yet to provide a patch or advisory, so the risk remains unmitigated until an update or remediation step is applied.