This vulnerability exists in the getDataBySQL function of the yudao-cloud product by YunaiV, specifically in version 2026.01. It allows remote attackers to perform SQL injection by manipulating input to the affected function, potentially compromising the database. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vendor has not provided any patch or remediation information, and the exploit is publicly available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. However, the impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation and parameterized queries if possible. Monitor for updates from the vendor or trusted security sources for an official patch or workaround.