CVE-2026-5596 is a SQL injection vulnerability discovered in griptape-ai griptape version 0.19.4, specifically within the SqlTool component located in griptape/tools/sql/tool.py. The vulnerability allows attackers to manipulate the tool's functionality through malicious SQL commands. The vulnerability carries a CVSS v3.1 score of 6.3 (Medium severity) and can be exploited remotely by authenticated users with low attack complexity. While the impact is limited to confidentiality, integrity, and availability of individual systems, the remote attack vector and low barrier to exploitation warrant attention from affected organizations. Exploit code is publicly available, though the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. Community attention remains minimal as reflected in the low EPSS score of 0.00029. The vendor was notified early but has not provided a response or mitigation guidance to date.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Griptape-Ai | Griptape | 0.19.4CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.