A flaw in the getDataBySQL method of YunaiV yudao‑cloud’s GoViewDataServiceImpl allows an attacker to supply arbitrary SQL statements that are executed against the database. The injection is performed through dynamic query construction, and the vendor’s description indicates the feature can be invoked remotely. Attackers can read, modify, or delete data, potentially compromising confidentiality and integrity of the system. The vulnerability is classified as CWE‑74 and CWE‑89.

The issue affects all releases of YunaiV yudao‑cloud up to and including version 2026.01. No specific patch version is listed, so any installation matching that version range is potentially vulnerable.

The CVSS score of 5.3 signals moderate severity, while an EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the vendor notes that the feature can be invoked over the network. A publicly available exploit exists, suggesting that attackers could attempt to exploit vulnerable instances despite the low EPSS value.