CVE-2026-84061
Received Received - Intake

SQL Injection Vulnerability in OpenChatBI

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulDB

Description
A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file openchatbi/text2sql/generate_sql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84061
EUVD
EUVD-2026-69063

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zhongyu09 openchatbi to 0.3.0 (inc)
zhongyu09 openchatbi From 0.2.0 (inc) to 0.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the OpenChatBI application up to version 0.3.0. The flaw exists in the _validate_sql_safety function of the generate_sql.py file. Attackers can remotely exploit this to inject malicious SQL code due to insufficient input validation.

Detection Guidance

This vulnerability involves SQL injection in OpenChatBI versions up to 0.3.0 due to insufficient SQL safety validation. To detect it, inspect the generate_sql.py file for the _validate_sql_safety function and check if SQL queries are properly sanitized. Look for versions v0.2.0 through v0.3.0 where validation is either missing or incomplete.

Impact Analysis

An attacker could exploit this to access, modify, or delete database contents. This may lead to unauthorized data exposure, data corruption, or system compromise depending on the database permissions.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data. Organizations using affected versions may face compliance penalties and reputational damage.

Mitigation Strategies

Immediately upgrade to a patched version of OpenChatBI if available. If using versions v0.2.0 through v0.2.2, disable SQL safety validation entirely. For v0.3.0 and v1.0.0b1/main, enable the stricter SQL safety mode if supported. Review and sanitize all SQL queries in the generate_sql.py file to prevent injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart