CVE-2026-72743 dataease CVE debrief

Who should care

Defenders responsible for SQLBot installations, particularly those using version 1.10.0 or earlier, should assess exposure and prioritize remediation. They should verify and update SQLBot installations to prevent exploitation and review compensating controls for exposed systems. Additionally, they should monitor dashboard text widget content for suspicious activity and implement additional security measures to prevent exploitation.

Why it matters

CVE-2026-72743 is a stored cross-site scripting vulnerability in SQLBot's SQText dashboard component, allowing attackers to inject arbitrary HTML and JavaScript. Defenders should prioritize verifying and updating SQLBot installations to prevent exploitation.

• Attackers can inject arbitrary HTML and JavaScript, executing for all users viewing the dashboard.
• Defenders must verify and update SQLBot installations to prevent exploitation.
• Remediation priority is high for SQLBot installations, especially those with untrusted users.

Technical summary

The vulnerability is in the SQText dashboard component of SQLBot, which renders TinyMCE output via v-html without sanitization. This allows attackers who can modify dashboard text widget content to inject arbitrary HTML and JavaScript. The vulnerability was fixed in commit c3f40a5. Defenders should prioritize verifying and updating SQLBot installations to prevent exploitation, especially for installations using version 1.10.0 or earlier. The vulnerability's scope and remediation require verification from official sources.

Defensive priority

Defenders should prioritize verifying and updating SQLBot installations to prevent exploitation.

Recommended defensive actions

• Verify SQLBot installations for version 1.10.0 or earlier
• Update SQLBot to commit c3f40a5 or later
• Monitor dashboard text widget content for suspicious activity
• Implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its scope and remediation require verification from official sources. The vulnerability affects SQLBot version 1.10.0 or earlier, and defenders should verify and update installations to prevent exploitation. The CVE Program and NVD provide source-provided CVE metadata and official vulnerability assessment, respectively. However, additional verification is necessary to ensure accurate affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.