CVE-2026-32622 affects SQLBot, an intelligent data query system leveraging a large language model (LLM) and retrieval-augmented generation (RAG). Versions 1.5.0 and below contain a critical stored prompt injection vulnerability resulting from a combination of three flaws. First, the Excel upload API lacks proper authorization checks, allowing any authenticated user to upload arbitrary terminology data. Second, the terminology descriptions are stored without sanitization, permitting dangerous payloads to persist in the system. Third, there is no semantic fencing when these terminologies are injected into the LLM’s system prompt, enabling attackers to influence the LLM’s reasoning process. By exploiting this chain, an attacker can craft malicious PostgreSQL commands such as COPY ... TO PROGRAM, which can execute arbitrary code on the database or application server with the privileges of the postgres user. This effectively grants remote code execution (RCE) capabilities. The vulnerability requires only authenticated access, no user interaction, and has a network attack vector with low complexity. The CVSS 4.0 score is 8.6 (high severity), reflecting the significant impact on confidentiality, integrity, and availability. The issue is resolved in SQLBot version 1.6.0.

The vulnerability allows attackers with authenticated access to escalate privileges and execute arbitrary code on the database or application server, potentially compromising the entire backend infrastructure. This can lead to unauthorized data access, data corruption, service disruption, and lateral movement within the network. Given the postgres user privileges, attackers can manipulate critical database operations, exfiltrate sensitive data, or deploy persistent backdoors. Organizations relying on SQLBot for intelligent data querying are at risk of severe operational and reputational damage. The lack of required user interaction and the network-based attack vector increase the likelihood of exploitation in environments where authentication is accessible, such as internal networks or exposed portals.

1. Immediately upgrade SQLBot to version 1.6.0 or later, where the vulnerability is patched. 2. Restrict access to the Excel upload API to only trusted and highly privileged users, implementing strict role-based access controls (RBAC). 3. Implement input validation and sanitization on all uploaded terminology data to prevent injection of malicious payloads. 4. Introduce semantic fencing or input context validation before injecting any user-controlled data into LLM prompts to prevent prompt injection attacks. 5. Monitor database logs for unusual PostgreSQL commands, especially those invoking COPY ... TO PROGRAM or other system-level operations. 6. Employ network segmentation and least privilege principles to limit the impact of potential compromises. 7. Conduct regular security audits and penetration testing focusing on LLM integration points and data ingestion APIs.