CVE-2026-84061: SQL Injection in zhongyu09 OpenChatBI

This vulnerability affects the _validate_sql_safety function in zhongyu09 OpenChatBI up to version 0.3.0, where improper or incomplete SQL safety validation allows remote attackers to manipulate input and perform SQL injection attacks. Earlier versions (0.2.0 to 0.2.2) have no SQL safety validation, and although version 0.3.0 introduced a validator, it remains incomplete and optional stricter modes exist only in later versions. The vendor has not provided any response or patch for this issue.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3, reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing additional input validation or filtering as a temporary mitigation. Monitor for updates from the vendor or community for any forthcoming patches.