CVE-2026-53555 Details
Description
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content. SQLBot later serves the file inline from the same application origin through GET /api/v1/system/assistant/picture/{filename}. When another user loads that generated resource, JavaScript embedded in the SVG executes in the SQLBot web application context, resulting in stored cross-site scripting with access to data and actions available to the victim's session. This issue is fixed in version 1.9.0.
A stored cross-site scripting vulnerability has been identified in SQLBot Community Edition versions prior to 1.9.0. The issue arises when an authenticated user uploads an SVG file as the assistant UI logo. The application accepts the SVG without proper validation or sanitization of embedded active content, such as JavaScript. Once uploaded, the SVG is served inline from the same application origin. When another user accesses the resource, the embedded JavaScript executes in the context of the SQLBot web application, leading to the execution of arbitrary scripts with access to the victim's session data and actions.
Users are advised to upgrade to SQLBot version 1.9.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/dataease/SQLBot/commit/835eefcb39b595248ea006f3cfce445d2f49167e | [email protected] | Source CodeVendor |
| https://github.com/dataease/SQLBot/pull/1160 | [email protected] | Issue TrackingVendor |
| https://github.com/dataease/SQLBot/releases/tag/v1.9.0 | [email protected] | Release NotesVendor |
| https://github.com/dataease/SQLBot/security/advisories/GHSA-v23m-5pvq-xcgx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SQLBot | < 1.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |