SQLBot, an intelligent Text-to-SQL system, suffers from a second-order SQL injection vulnerability (CWE-89) in versions before 1.9.0. An authenticated user can submit a malicious tableName in the Excel datasource configuration via POST /api/v1/datasource/. This value is stored unsafely and later used in a DELETE /api/v1/datasource/{id} operation, where it is interpolated into a SQL cleanup command executed by PostgreSQL. This allows invocation of PostgreSQL's COPY TO PROGRAM feature, enabling arbitrary OS command execution with the privileges of the postgres process within the SQLBot container. The issue is resolved in version 1.9.0.

Successful exploitation allows an authenticated user with low privileges to execute arbitrary operating system commands on the host running SQLBot with the privileges of the postgres process inside the container. This can lead to full system compromise of the container environment. The vulnerability requires authentication and has a high attack complexity due to the need to craft specific input and trigger the deletion operation.

Upgrade SQLBot to version 1.9.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Users should apply this official fix to prevent exploitation.