CVE-2026-7023: SQL Injection in ByteDance coze-studio
A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
This vulnerability exists in ByteDance coze-studio up to version 0.5.1 within the ExecuteSQL function of backend/domain/memory/database/service/database_impl.go. It allows remote attackers to perform SQL injection by manipulating inputs to the databaseTool component. The vulnerability is confirmed and publicly disclosed, with no vendor remediation or patch available at this time. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation can lead to unauthorized SQL query execution, potentially allowing attackers to access or modify database contents. However, the impact is rated low on confidentiality, integrity, and availability, resulting in an overall medium severity. There are no known exploits in the wild currently.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider applying input validation or other protective controls around the affected ExecuteSQL function to mitigate risk until an official fix is released.
CVE-2026-7023: SQL Injection in ByteDance coze-studio
Description
A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in ByteDance coze-studio up to version 0.5.1 within the ExecuteSQL function of backend/domain/memory/database/service/database_impl.go. It allows remote attackers to perform SQL injection by manipulating inputs to the databaseTool component. The vulnerability is confirmed and publicly disclosed, with no vendor remediation or patch available at this time. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation can lead to unauthorized SQL query execution, potentially allowing attackers to access or modify database contents. However, the impact is rated low on confidentiality, integrity, and availability, resulting in an overall medium severity. There are no known exploits in the wild currently.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider applying input validation or other protective controls around the affected ExecuteSQL function to mitigate risk until an official fix is released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-25T13:56:49.168Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Epss Score
- 0.00026
- Epss Percentile
- 0.07322
- Epss Date
- 2026-04-26
- Gcve Source
- db.gcve.eu
Threat ID: 69edb5dc87115cfb68d4ecab
Added to database: 4/26/2026, 6:51:08 AM
Last enriched: 5/3/2026, 7:22:45 AM
Last updated: 6/10/2026, 12:01:50 PM
Views: 107
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.