CyberRota Analysis
AI-GeneratedA critical stacked SQL injection vulnerability exists in R2R versions up to 3.6.6, allowing unauthenticated attackers to execute arbitrary SQL commands by exploiting the index name parameter in the vector index creation endpoint. This flaw enables attackers to perform unauthorized data manipulation and definition language operations with superuser privileges in PostgreSQL. Organizations using affected versions should prioritize immediate remediation to mitigate the risk of severe data breaches or system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.