CVE-2026-85689: llmware 0.4.6 SQL Injection via unescaped filter values
llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, in both the SQLite and PostgreSQL backends. The filter validator only checks keys against an allow-list and never sanitizes values. Attacker-controlled filter values reaching the public API via Library.blocklookup and Query.textquerywithcustomfilter / textquerybyauthororspeaker can neutralize the intended filter to disclose rows the caller was scoped out of (cross-document/cross-collection disclosure); on PostgreSQL the flaw permits boolean- and UNION-based SQL injection.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs low-privilege access and the ability to supply controlled filter or lookup values through the affected public API paths. No user interaction is required.
Which application paths should be prioritized for review?
Review uses of Library.block_lookup, Query.text_query_with_custom_filter, and Query.text_query_by_author_or_speaker where filter or lookup values can originate from an untrusted caller.
Does the impact differ between supported database backends?
Yes. The issue can bypass intended row-scoping filters in both SQLite and PostgreSQL, while PostgreSQL is also described as permitting boolean-based and UNION-based SQL injection.