CVE-2026-53557: SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe identifier handling. When the same datasource is later removed through DELETE /api/v1/datasource/{id}, the stored value is interpolated into datasource cleanup SQL and executed by PostgreSQL. This second-order SQL injection can invoke PostgreSQL COPY TO PROGRAM and execute arbitrary operating-system commands with the privileges of the postgres process inside the SQLBot container. This issue is fixed in version 1.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLBotto a version that resolves this vulnerability.Fixed in 1.9.0 - Compensating control
Review and restrict access to the datasource management API endpoints (/api/v1/datasource/ via POST and /api/v1/datasource/{id} via DELETE) so only trusted/admin users can create or delete Excel datasources.
- Operational
After upgrading to 1.9.0, assume possible exploitation and check for and remediate any operating-system commands that may have run inside the SQLBot container (postgres process privileges).
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SQLBot user who can submit an Excel datasource configuration through POST /api/v1/datasource/ can store a crafted sheet["tableName"] value. Exploitation is triggered later when that datasource is deleted through DELETE /api/v1/datasource/{id}.
What level of access can successful exploitation provide?
The SQL injection can use PostgreSQL COPY TO PROGRAM to run arbitrary operating-system commands. Those commands run with the privileges of the postgres process inside the SQLBot container.
Are current deployments affected?
SQLBot versions prior to 1.9.0 are affected. Version 1.9.0 fixes the issue.