The vulnerability exists in R2R versions up to 3.6.6 and allows an unauthenticated attacker to inject arbitrary SQL statements into the CREATE INDEX command used by the vector index creation endpoint. The index name parameter is concatenated directly into the SQL statement without any quoting or allowlist validation, enabling execution of semicolon‑separated statements that run as the PostgreSQL superuser. This flaw permits the attacker to perform both data modification and data definition operations on the database, effectively delivering remote code execution on the underlying database system.

SciPhi‑AI R2R processors running versions 3.6.6 or earlier are affected by this injection flaw. No later versions are listed as vulnerable in the available data.

The CVSS score of 9.3 indicates high severity, and the absence of an EPSS score means exploitation probability is currently unknown, but the flaw is publicly disclosed and could be exploited locally or remotely through existing connectivity to the vector index creation endpoint without authentication.