SQLBot, an intelligent Text-to-SQL system, contains a SQL injection vulnerability (CWE-89) in versions before 1.9.0. The vulnerability exists in the POST /api/v1/datasource/previewData endpoint within backend/apps/datasource/crud/datasource.py, where the client-controlled table_name parameter is incorporated into SQL queries without safe identifier handling. An authenticated user can exploit this to invoke PostgreSQL functions such as pg_read_file(), pg_read_binary_file(), or pg_ls_dir() under a read-only policy, but due to the default trusted loopback authentication accepting invalid credentials, the internal PostgreSQL connection runs with superuser privileges. This enables reading sensitive filesystem files like /etc/hosts and /etc/passwd, potentially exposing configuration, credentials, authentication secrets, and source code. The vulnerability is resolved in SQLBot version 1.9.0.

An authenticated attacker can exploit this SQL injection to read arbitrary files on the server filesystem via PostgreSQL superuser privileges, potentially exposing sensitive information including configuration files, credentials, authentication secrets, and source code. The vulnerability requires authenticated access and has a medium severity score (CVSS 6.0). There are no known exploits in the wild.

Upgrade SQLBot to version 1.9.0 or later, where this SQL injection vulnerability is fixed. Until then, restrict access to the affected endpoint to trusted users only and avoid configurations that allow the internal PostgreSQL connection to accept invalid credentials with superuser privileges. Patch status is confirmed fixed in version 1.9.0.