CVE-2026-53555 in SQLBot
Summary
by MITRE • 09/18/2026
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content. SQLBot later serves the file inline from the same application origin through GET /api/v1/system/assistant/picture/{filename}. When another user loads that generated resource, JavaScript embedded in the SVG executes in the SQLBot web application context, resulting in stored cross-site scripting with access to data and actions available to the victim's session. This issue is fixed in version 1.9.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within SQLBot versions prior to 1.9.0 represents a critical security flaw rooted in improper input validation and output encoding, specifically manifesting as stored cross-site scripting. SQLBot operates as an intelligent text-to-sql system leveraging large language models and retrieval-augmented generation techniques. The core of the issue lies in the application's handling of file uploads through its administrative interface. An authenticated user with upload privileges can exploit a specific endpoint to inject malicious content into the server-side storage, which is subsequently served back to other users without adequate sanitization.
The technical flaw centers on the PATCH /api/v1/system/assistant/ui API endpoint. This endpoint allows an authenticated uploader to submit an image file designated as svg+xml for use as an assistant UI logo. The application fails to sanitize or validate active content embedded within these SVG files before storing them. Unlike standard image formats that are rendered statically, Scalable Vector Graphics support the inclusion of JavaScript code through elements such as script tags or event handlers like onload. Because SQLBot does not strip out this executable content during the upload process, malicious scripts become permanently stored on the server alongside legitimate assets.
The operational impact is severe due to the manner in which these files are served and consumed. The application retrieves the uploaded SVG file via the GET /api/v1/system/assistant/picture/{filename} endpoint and serves it inline from the same origin as the main web application. When a victim user, such as an administrator or another authenticated employee, loads this resource within their browser session, the embedded JavaScript executes in the context of the SQLBot domain. This results in stored cross-site scripting where the attacker's code runs with the privileges and permissions of the victim's active session.
This execution environment grants the malicious script full access to data and actions available to the victim. The attacker can potentially exfiltrate sensitive database queries, user credentials, or system configurations generated by SQLBot. Furthermore, because the script operates within the trusted origin, it can perform state-changing actions on behalf of the victim without their knowledge, such as modifying system settings, deleting records, or initiating unauthorized text-to-sql conversions that could lead to further data leakage if combined with other vulnerabilities. This aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation and is categorized under MITRE ATT&CK technique T1059 Command and Scripting Interpreter within the context of client-side code execution.
To mitigate this vulnerability, organizations must upgrade to SQLBot version 1.9.0 or later, where the issue has been resolved through improved input validation and sanitization mechanisms. In environments where immediate patching is not feasible, defensive measures should include implementing strict Content Security Policy headers that restrict script execution from inline sources and media types. Additionally, server-side configuration can be adjusted to serve uploaded SVG files with a content-disposition header set to attachment rather than inline, forcing the browser to download the file instead of rendering it directly in the page context. Input validation rules should also be enforced at the API gateway level to reject any SVG uploads containing script tags or event handler attributes before they reach the application logic.