This vulnerability involves an SQL injection flaw in the SqlTool component of griptape-ai griptape 0.19.4, located in griptape/tools/sql/tool.py. The exact functionality affected is unspecified. The vulnerability can be exploited remotely without user interaction or elevated privileges, with low complexity and low impact on confidentiality, integrity, and availability. The exploit is publicly known, but no official fix or remediation has been provided by the vendor as of the publication date.

Successful exploitation could allow an attacker to inject malicious SQL commands remotely, potentially leading to unauthorized data access or manipulation within the affected component. However, the CVSS score of 5.3 and vector indicate limited impact on confidentiality, integrity, and availability, and no privileges or user interaction are required. There are no known exploits in the wild beyond the public exploit availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider restricting access to the vulnerable component and monitor for any updates from the vendor. Avoid exposing the SqlTool functionality to untrusted networks until a patch or official mitigation is available.