The vulnerability resides in an unspecified function of the Multi‑stage Text2SQL Workflow component of zhongyu09 openchatbi. Manipulating the arguments supplied to this function can inject arbitrary SQL statements into database queries. Successful exploitation can result in unauthorized reading, modification, or deletion of database contents, compromising the confidentiality, integrity, and availability of stored data.

The flaw affects all installations of zhongyu09 openchatbi with versions up to and including 0.2.1. No specific vulnerable sub‑components are listed beyond the unnamed function referenced in the description.

The CVSS score of 5.3 represents a moderate severity vulnerability that does not directly lead to system compromise but allows data exfiltration or alteration. EPSS data is unavailable, but public disclosure indicates that the exploit is known and could be deployed remotely. The vendor has yet to provide a patch or advisory, so the risk remains unmitigated until an update or remediation step is applied.