Read the docs
TI-2026-57800 Aliases CVE-2026-84061GHSA-cx4x-wgfr-9r87

zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection

Priority MEDIUM 57CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file openchatbi/text2sql/generate_sql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zhongyu09OpenChatBI0.1; 0.2; 0.3.0—No fix listedCNA
  • OpenChatBI Vendorzhongyu09 Affected 0.1; 0.2; 0.3.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:zhongyu09:openchatbi:*:*:*:*:*:*:*:*——zhongyu09
  • cpe:2.3:a:zhongyu09:openchatbi:*:*:*:*:*:*:*:* Versions — — ·zhongyu09

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84061
  2. 2026-10-03 Alias added: GHSA-cx4x-wgfr-9r87

References

—

  • TI-2026-22990 OpenChatBI: Critical Path Traversal Vulnerability in save_report Tool of OpenChatBI CVSS 4.0HIGH 8.7
  • TI-2026-04897 zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injection CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences