CVE-2026-32622 is a critical Stored Prompt Injection vulnerability affecting SQLBot versions 1.5.0 and below, an intelligent data query system. This flaw chains a missing permission check, unsanitized data storage, and lack of semantic fencing, allowing any authenticated user to upload malicious terminology via an Excel API. This can hijack the LLM's reasoning to generate dangerous PostgreSQL commands, ultimately leading to Remote Code Execution on the database or application server with postgres user privileges. Rated 8.8 HIGH CVSS, this vulnerability has no current evidence of active exploitation, public exploit code, or significant community discussion. Organizations should upgrade to SQLBot v1.6.0 or later to remediate this issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.0CPE matchmatch criteria | cpe:2.3:a:fit2cloud:sqlbot:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.