PT-2026-30453 · Zhongyu09 · Openchatbi

Goku · Published 2026-04-05 · Updated 2026-05-20 · CVE-2026-5586

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zongyu09 openchatbi versions up to 0.2.1

Description A flaw exists in the Multi-stage Text2SQL Workflow component of zhongyu09 openchatbi. Manipulation of the keywords argument can result in SQL injection. This issue can be exploited remotely. The vulnerability has been publicly disclosed.

Recommendations Versions prior to 0.2.1 should be updated.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-5586

Affected Products

Openchatbi

References · 11

• 🔥 https://github.com/Ka7arotto/cve/blob/main/openchatbi-SQL/issue.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5586 · Security Note
• https://github.com/zhongyu09/openchatbi/issues/11 · Note
• https://t.me/cveNotify/164181 · Telegram Post
• https://twitter.com/infoflowcloud/status/2040862207982895462 · Twitter Post
• https://vuldb.com/submit/784454 · Note
• https://vuldb.com/vuln/355385/cti · Note
• https://vuldb.com/vuln/355385 · Note
• https://twitter.com/CVEnew/status/2040861187999482052 · Twitter Post
• https://twitter.com/cyberbivash/status/2040888854375231952 · Twitter Post
• https://github.com/zhongyu09/openchatbi · Note