What happened
SQLBot's data-preview endpoint is vulnerable to SQL injection via an unsanitized table name parameter.
Why it matters
Continues the pattern of unsafe SQL construction across SQLBot's datasource-handling endpoints in this LLM/RAG-based query tool.
Attack vector
The POST /api/v1/datasource/previewData endpoint incorporates a client-controlled table_name value into generated SQL without safe identifier handling.
Affected systems
SQLBot < 1.9.0
Mitigation
Upgrade to SQLBot 1.9.0 or later.