This vulnerability affects zhongyu09 openchatbi up to version 0.2.1 in an unspecified function within the Multi-stage Text2SQL Workflow component. By manipulating the 'keywords' argument, an attacker can perform SQL injection remotely without user interaction or elevated privileges. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, and low to limited impact on confidentiality, integrity, and availability. The vendor has not provided any remediation or patch, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No evidence of active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor, who has not responded to the vulnerability disclosure. Users should monitor vendor communications for updates. Until a patch is released, consider applying application-level input validation or using web application firewalls to detect and block SQL injection attempts targeting the 'keywords' parameter.