This vulnerability affects ByteDance coze-studio up to version 0.5.1 in the ExecuteSQL function of the databaseTool component. It allows remote attackers to perform SQL injection by manipulating inputs to the ExecuteSQL function, potentially compromising the underlying database. The vulnerability is publicly disclosed with exploit code available, but no vendor response or patch has been issued. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the affected database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the database managed by the vulnerable function. No evidence of active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. In the meantime, applying input validation and sanitization on all inputs to the ExecuteSQL function may reduce risk. Consider restricting network access to the affected service to trusted sources to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.