The vulnerability CVE-2026-5596 in griptape-ai griptape 0.19.4 allows remote attackers to perform SQL injection via the SqlTool component in griptape/tools/sql/tool.py. The exact functionality affected is unspecified. The vulnerability requires no user interaction and can be exploited over the network with low attack complexity. The vendor has not provided a patch or remediation guidance, and the exploit is publicly available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend SQL queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 5.3 (medium), reflecting limited impact due to low privileges required but low confidentiality, integrity, and availability impact. No known exploits in the wild have been reported beyond the public exploit code.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting network access to the vulnerable component or applying application-level input validation and sanitization to mitigate SQL injection risks.