The eyecix Addon Jobsearch Chat addon suffers from an SQL Injection vulnerability (CVE-2026-25377) affecting versions up to 3.0. This occurs because the addon does not properly neutralize special characters in SQL commands, allowing attackers to inject arbitrary SQL code. The vulnerability is remotely exploitable without requiring user interaction or privileges, potentially leading to unauthorized disclosure of sensitive data. The CVSS 3.1 base score is 9.3, reflecting critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact. No patch or official remediation guidance is currently available.

Successful exploitation of this SQL Injection vulnerability could allow an attacker to access or disclose sensitive database information due to improper input sanitization. The vulnerability does not affect integrity but can cause partial availability loss. The critical CVSS score reflects the potential severity of data exposure. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation and sanitization controls at the application or database level as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.