CVE-2026-84061: zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection
A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function validatesqlsafety of the file openchatbi/text2sql/generatesql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zhongyu09 OpenChatBIto a version that resolves this vulnerability.Fixed in 0.3.0 - Upgrade
Upgrade
zhongyu09 OpenChatBIto a version that resolves this vulnerability.Fixed in 1.0.0b1 - Configuration
Enable the optional stricter mode in _validate_sql_safety (introduced/available in v1.0.0b1/main) to strengthen SQL injection protection.
zhongyu09 OpenChatBI - openchatbi/text2sql/generate_sql.py (_validate_sql_safety) stricter mode for SQL safety validation = enabled
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attack can be initiated remotely and requires low privileges. No user interaction is required.
Are deployments running versions with SQL safety validation protected?
No. Version 0.3.0 introduced SQL safety validation, but the validator is described as incomplete; v1.0.0b1 and the main branch retained the same incomplete validator. An optional stricter mode exists in v1.0.0b1/main, but the available information does not establish that it fully mitigates the issue.
Which versions should be considered exposed?
Versions v0.2.0 through v0.2.2 have no SQL safety validation at all. The issue is reported in OpenChatBI up to 0.3.0, with the same incomplete validation also noted in v1.0.0b1 and main.
Is a vendor fix or workaround documented?
No vendor fix or workaround is provided in the available information. The vendor was contacted about the disclosure but did not respond.