| शीर्षक | griptape v0.19.4 SQL Injection |
|---|
| विवरण | The SqlTool in Griptape allows agents to execute arbitrary SQL queries generated by the LLM against the connected database. There is no validation to restrict the types of SQL commands that can be executed.
An attacker can use prompt injection to coerce the LLM into generating malicious SQL statements. This can lead to Remote Code Execution (RCE) via features like COPY ... FROM PROGRAM, as well as arbitrary file read/write, data exfiltration, or, even with least priviledge, Denial of Service using CTE |
|---|
| स्रोत | ⚠️ https://github.com/Ka7arotto/cve/blob/main/griptape/text2sqlTool/issue.md |
|---|
| उपयोगकर्ता | Goku (UID 80486) |
|---|
| सबमिशन | 21/03/2026 03:04 AM (7 महीनों पहले) |
|---|
| संयम | 05/04/2026 07:17 AM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355390 [griptape-ai griptape 0.19.4 SqlTool tool.py SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|