CVE-2026-7023

Name of the Vulnerable Software and Affected Versions coze-studio versions prior to 0.5.2

Description A SQL injection issue exists in the databaseTool component within the ExecuteSQL() function of the backend/domain/memory/database/service/database impl.go file. This flaw allows a remote attacker to perform manipulations that result in unauthorized SQL command execution.

Recommendations Update to a version later than 0.5.1. As a temporary workaround, restrict access to the ExecuteSQL() function within the databaseTool component to minimize the risk of exploitation.