Description

A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file openchatbi/text2sql/generate_sql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-01T13:20:05.200Z",
  "pubdate": "2026-09-01T13:20:05.200Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in OpenChatBI, identified in versions up to 0.3.0, and persisting in v1.0.0b1 and main branches. The vulnerability resides within the _validate_sql_safety function, which fails to adequately sanitize input, allowing for the execution of arbitrary SQL commands.\nThis vulnerability is classified as an SQL injection, which can be initiated remotely without requiring authentication. Successful exploitation allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exfiltration, modification, or deletion. Given the nature of text-to-SQL applications, which inherently bridge natural language inputs to database execution, the risk is severe. The lack of a robust, bypass-proof validation mechanism in the affected versions means that any system deploying OpenChatBI is at high risk of compromise if exposed to untrusted inputs.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate implementation of input sanitization and validation within the _validate_sql_safety function located in openchatbi/text2sql/generate_sql.py. The application is designed to convert natural language queries into SQL, but fails to implement a secure, whitelist-based approach to filter the generated SQL before execution.\nThe vulnerability manifests differently across versions: in v0.2.0 through v0.2.2, there is a total absence of SQL safety validation. Consequently, any natural language prompt that results in a malicious SQL payload is executed directly against the database. In v0.3.0, a validator was introduced, but it remains structurally flawed and incomplete, failing to effectively block injection attempts. This flawed validation mechanism persists into v1.0.0b1 and the main branch, even with the inclusion of an optional stricter mode, which remains insufficient to mitigate the risk of sophisticated SQL injection.\nThe attack flow proceeds as follows: An attacker sends a crafted natural language query to the OpenChatBI interface. This input is processed by the text-to-SQL generation engine, which constructs a malicious SQL statement. Because the _validate_sql_safety function relies on deficient logic, it permits the generated malicious query to pass through its security checks. Finally, the application executes the unvalidated SQL against the backend database with the privileges of the application's database user. The attacker does not need to bypass authentication, as the attack is initiated remotely against the exposed service. By leveraging this vulnerability, an attacker can craft payloads to perform unauthorized data extraction (blind or error-based SQLi), modify records, or in certain database configurations, escalate privileges and interact with the underlying filesystem."
}