SQLBot versions through 1.10.0 contain a stored cross‑site scripting flaw in the SQText dashboard component. The component renders TinyMCE output via v-html without any sanitization. If an attacker can modify the content of a dashboard text widget, they can inject arbitrary HTML or JavaScript. When any user views the affected dashboard, the injected code executes in that user’s browser, enabling session hijacking, data theft, or other malicious actions. The weakness is a classic stored XSS (CWE‑79).

The vulnerability is present in the Dataease SQLBot product, version 1.10.0 and earlier. It was fixed in the commit identified by c3f40a5. Users running these unpatched versions are impacted.

The CVSS score is 5.1, indicating a moderate impact. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attacking the flaw requires the ability to alter the dashboard text widget – either through privileged user access or another pre‑existing compromise. Once the widget is modified, the injected payload is delivered to all subsequent viewers, so the attack surface extends to every user who can view the dashboard.