{"id":"CVE-2025-7894","summary":"Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection","details":"A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1. This issue affects the function generate_simple_sql of the file backend/onyx/agents/agent_search/kb_search/nodes/a3_generate_simple_sql.py of the component Chat Interface. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","modified":"2026-07-15T01:48:57.245874534Z","published":"2025-07-20T14:02:07.096Z","database_specific":{"cwe_ids":["CWE-74","CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7894.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.29.0"},{"last_affected":"0.29.0"},{"introduced":"0.29.1"},{"last_affected":"0.29.1"}]}],"cna_assigner":"VulDB"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7894.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7894"},{"type":"ADVISORY","url":"https://vuldb.com/?id.317009"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.615322"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.317009"},{"type":"EVIDENCE","url":"https://www.cnblogs.com/aibot/p/18982747"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/onyx-dot-app/onyx","events":[{"introduced":"0"},{"last_affected":"71712df3202bb6a31d20756cbcaf972b8bfac09e"}],"database_specific":{"cpe":"cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"0.29.1"}],"source":"CPE_RANGE"}}],"versions":["v0.29.1","v0.29.0-beta.1","v0.29.0","v0.24.0-cloud.64","nightly-latest-20250521","nightly-latest-20250503","v0.24.0-cloud.55","nightly-latest-20250509","v0.24.0-cloud.63","nightly-latest-20250520","nightly-latest-20250519","nightly-latest-20250518","nightly-latest-20250517","v0.24.0-cloud.61","nightly-latest-20250516","nightly-latest-20250515","v0.24.0-cloud.60","nightly-latest-20250514","v0.24.0-cloud.58","nightly-latest-20250513","v0.24.0-cloud.56","nightly-latest-20250512","nightly-latest-20250511","nightly-latest-20250510","nightly-latest-20250508","nightly-latest-20250507","v0.28.0-beta.1","v0.28.0","nightly-latest-20250506","nightly-latest-20250505","nightly-latest-20250504","nightly-latest-20250502","highspot-special-tag-2","v0.24.0-cloud.51","v0.24.0-cloud.50","nightly-latest-20250501","highspot-special-tag","v0.24.0-cloud.49","nightly-latest-20250430","nightly-latest-20250429","nightly-latest-20250428","v0.28.0-candidate","nightly-latest-20250427","nightly-latest-20250426","v0.24.0-cloud.48","nightly-latest-20250425","nightly-latest-20250424","v0.24.0-cloud.47","nightly-latest-20250423","v0.24.0-cloud.46","v0.24.0-cloud.45","nightly-latest-20250422","v0.26.0-beta.2","v0.26.0","nightly-latest-20250421","nightly-latest-20250420","nightly-latest-20250419","nightly-latest-20250418","nightly-latest-20250417","nightly-latest-20250416","v0.27.0-beta.1","v0.27.0","nightly-latest-20250415","nightly-latest-20250414","nightly-latest-20250413","nightly-latest-20250412","v0.24.0-cloud.33","nightly-latest-20250411","nightly-latest-20250410","v0.24.0-cloud.32","nightly-latest-20250409","v0.24.0-cloud.31","nightly-latest-20250408","nightly-latest-20250320","nightly-latest-20250407","nightly-latest-20250406","nightly-latest-20250405","v0.24.0-cloud.30","nightly-latest-20250404","v0.24.0-cloud.29","v0.24.0-cloud.27","nightly-latest-20250403","v0.24.0-cloud.26","v0.24.0-cloud.25","nightly-latest-20250402","confluence-patch-04.1.2025","v0.24.0-cloud.24","v0.24.0-cloud.23","nightly-latest-20250331.1","nightly-latest-20250331","nightly-latest-20250330","nightly-latest-20250329","nightly-latest-20250328","v0.24.0-cloud.6","v0.24.0-cloud.5","nightly-latest-20250327","nightly-latest-20250326","nightly-latest-20250324","nightly-latest-20250325","nightly-latest-20250323","nightly-latest-20250322","nightly-latest-20250321-patch.1","nightly-latest-20250321","v0.24.0-cloud.1","nightly-latest-20250319","nightly-latest-20250318","nightly-latest-20250317","nightly-latest-20250316","nightly-latest-20250315","v0.25.0-beta.1","nightly-latest-20250314","nightly-latest-20250313","nightly-latest-20250312","nightly-latest-20250311","nightly-latest-20250310","nightly-latest-20250309","nightly-latest-20250308","nightly-latest-20250307","v0.23.0-cloud.4","nightly-latest-20250306","v0.23.0-beta.1","v0.23.0","v0.24.0-beta.1","nightly-latest-20250305","v0.23.0-cloud.3","nightly-latest-20250304","nightly-latest-20250303","nightly-latest-20250302","v0.23.0-cloud.1","nightly-latest-20250301","v0.23.0-cloud.0","v0.20.0-cloud.84","nightly-latest-20250228","nightly-latest-20250227","nightly-latest-20250226","v0.20.0-cloud.76","nightly-latest-20250225","v0.20.0-cloud.73","nightly-latest-20250224","nightly-latest-20250223","nightly-latest-20250222","nightly-latest-20250221","nightly-latest-20250220","nightly-latest-20250219","v0.20.0-cloud.57","nightly-latest-20250218","nightly-latest-20250217","nightly-latest-20250216","nightly-latest-20250215","v0.20.0-cloud.41","nightly-latest-20250214","v0.22.0-beta.1","v0.20.0-cloud.36","v0.20.0-cloud.35","nightly-latest-20250212-early","nightly-latest-20250213","v0.20.0-cloud.31","nightly-latest-20250212","v0.20.0-cloud.28","nightly-latest-20250211","v0.21.0-beta.1","v0.21.0","v0.19.0-cloud.62","nightly-latest-20250130","nightly-latest-20250210","nightly-latest-20250209","nightly-latest-20250208","nightly-latest-20250207","nightly-latest-20250205","nightly-latest-20250206","v0.20.0-cloud.6","v0.20.0-cloud.5","nightly-latest-20250204","v0.19.0-cloud.75","nightly-latest-20250203","v0.19.0-cloud.74","v0.19.0-cloud.73","nightly-latest-20250202","v0.19.0-cloud.71","nightly-latest-20250201","v0.19.0-cloud.68","v0.19.0-cloud.67","nightly-latest-20250131","v0.19.0-cloud.66","v0.19.0-cloud.65","nightly-latest-20250129","v0.19.0-cloud.59","v0.19.0-cloud.58","nightly-latest-20250128","nightly-latest-20250127","nightly-latest-20250126","v0.19.0-cloud.45","nightly-latest-20250125","nightly-latest-20250124","v0.19.0-cloud.39","v0.19.0-cloud.41","nightly-latest-20250123","nightly-latest-20250122","v0.20.0-beta.1","v0.20.0","nightly-latest-20250121","v0.19.0-cloud.26","nightly-latest-20250120","v0.19.0-cloud.18","nightly-latest-20250119","nightly-latest-20250118","v0.19.0-cloud.15","nightly-latest-20250117","nightly-latest-20250116","v0.19.0-cloud.13","v0.19.0-cloud.10","nightly-latest-20250115","nightly-latest-20250114","nightly-latest-20250113","nightly-latest-20250112","nightly-latest-20250111","nightly-latest-20241120","nightly-latest-20250110","v0.19.0-beta.1","v0.18.0-cloud.15","nightly-latest-20250109","v0.18.0-cloud.34","v0.18.0-cloud.31","nightly-latest-20250108","nightly-latest-20250107","v0.18.0-cloud.23","nightly-latest-20250106","v0.18.0-cloud.22","v0.18.0-cloud.20","v0.18.0-cloud.19","nightly-latest-20250105","v0.18.0-cloud.12","nightly-latest-20250104","nightly-latest-20250103","nightly-latest-20250102","v0.18.0-cloud.13","nightly-latest-20250101","v0.18.0-cloud.11","v0.18.0-cloud.10","nightly-latest-20241231","nightly-latest-20241230","v0.18.0-cloud.9","v0.18.0-cloud.8","v0.18.0-cloud.6","nightly-latest-20241229","nightly-latest-20241228","nightly-latest-20241227","nightly-latest-20241226","nightly-latest-20241225","nightly-latest-20241224","nightly-latest-20241223","v0.18.0-cloud.3","nightly-latest-20241222","nightly-latest-20241221","v0.18.0-cloud.1","nightly-latest-20241220","nightly-latest-20241219","nightly-latest-20241218","v0.18.0-beta.2","v0.15.0-cloud.beta.23","v0.18.0-beta.1","v0.18.0","nightly-latest-20241217","nightly-latest-20241216","v0.15.0-cloud.beta.21","nightly-latest-20241215","v0.15.0-cloud.beta.20","v0.15.0-cloud.beta.19","nightly-latest-20241213","v0.15.0-cloud.beta.17","v0.15.0-cloud.beta.15","v0.15.0-cloud.beta.13","nightly-latest-20241212","v0.15.0-cloud.beta.12","nightly-latest-20241211","v0.15.0-cloud.beta.8","v0.15.0-cloud.beta.7","v0.15.0-cloud.beta.4","v0.15.0-cloud.beta.2","nightly-latest-20241210","nightly-latest-20241209","v0.15.0-cloud.beta.1","teams-improvements","nightly-latest-20241208","nightly-latest-20241207","vespa-more-retries","nightly-latest-20241206","nightly-latest-20241205","nightly-latest-20241204","v0.16.0-beta.1","v0.15.0-beta.1","v0.14.0-cloud.beta.0","nightly-latest-20241127","nightly-latest-20241203","nightly-latest-20241202","nightly-latest-20241201","nightly-latest-20241130","nightly-latest-20241129","nightly-latest-20241128","nightly-latest-20241126","nightly-latest-20241125","nightly-latest-20241124","nightly-latest-20241123","nightly-latest-20241122","v0.13.0-cloud.beta.2","nightly-latest-20241121","v0.14.0-beta.1","nightly-latest-20241119","nightly-latest-20241118","nightly-latest-20241117","v0.12.0-cloud.beta.17","nightly-latest-20241116","nightly-latest-20241115","v0.13.0-beta.1","nightly-latest-20241112","nightly-latest-20241114","v0.12.0-cloud.beta.16","nightly-latest-20241113","nightly-latest-20241111","nightly-latest-20241110","nightly-latest-20241109","v0.12.0-cloud.beta.0","nightly-latest-20241108","nightly-latest-20241107","nightly-latest-20241106","v0.12.0-beta.1","nightly-latest-20241105","v0.11.0-cloud.beta.6","nightly-latest-20241104","v0.11.0-cloud.beta.5","nightly-latest-20241103","nightly-latest-20241102","nightly-latest-20241031","nightly-latest-20241101","v0.11.0-cloud.beta.1","nightly-latest-20241030","v0.11.0-beta.1","nightly-latest-20241029","nightly-latest-20241028","v0.10.0-cloud.beta.9","v0.10.0-cloud.beta.10","v0.10.0-cloud.beta.8","nightly-latest-20241027","v0.9.0","v0.10.0-cloud.beta.7","v0.10.0-cloud.beta.6","v0.10.0-beta.6","nightly-latest-20241026","v0.10.0-cloud.beta.5","nightly-latest-20241025","v0.10.0-beta.5","v0.10.0-beta.4","v0.10.0-beta.3","nightly-latest-20241024","v0.10.0-beta.2","v0.9.0-beta.6","nightly-latest-20241020","nightly-latest-20241023","notion-patch-20241022","nightly-latest-20241022","v0.10.0-beta.1","nightly-latest-20241021","nightly-latest-20241019","v0.9.0-beta.5","v0.9.0-beta.4","nightly-latest-20241018","v0.9.0-beta.3","v0.9.0-beta.2","nightly-latest-20241017","nightly-latest-20241016","v0.9.0-beta.1","nightly-latest-20241015","v0.7.8","v0.7.7","v0.7.6","nightly-latest-20241014","nightly-latest-20241011","nightly-latest-20241013","v0.7.5","nightly-latest-20241012","nightly-latest-20241010","v0.8.0-beta.1","nightly-latest-20241008","nightly-latest-20241009","experimental-1","nightly-latest-20241007","nightly-latest-20241006","nightly-latest-20241005","nightly-latest-20241004","nightly-latest-20241003","v0.7.0-beta.1","nightly-latest-20241001","nightly-latest-20241002","nightly-latest-20240930","nightly-latest-20240929","nightly-latest-20240928","nightly-latest-20240927","v0.6.0-beta.1","v0.5.26","v0.5.25","v0.5.24","v0.5.23","v0.5.22","v0.5.21","v0.5.20","v0.5.19","v0.5.18","v0.5.17","v0.5.16","v0.5.15","v0.5.14","v0.5.13","v0.5.11","v0.5.10","v0.5.9","v0.5.8","v0.5.7","v0.5.5","v0.5.6","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.28","v0.4.27","v0.4.26","v0.4.25","v0.4.23","v0.4.22","v0.4.21","v0.4.20","v0.4.19","v0.4.18","v0.4.17","v0.4.16","v0.4.15","v0.4.14","v0.4.13","v0.4.12","v0.4.11","v0.4.10","v0.4.9","v0.4.8","v0.4.7","v0.4.6","v0.4.5","0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.3.95","v0.3.94","v0.3.93","v0.3.92","v0.3.91","v0.3.90","v0.3.89","v0.3.88","v0.3.87","v0.3.86","v0.3.85","v0.3.82","v0.3.81","v0.3.80","v0.3.79","v0.3.78","v0.3.77","v0.3.76","v0.3.75","v0.3.74","v0.3.73","v0.3.72","v0.3.71","v0.3.70","v0.3.69","v0.3.68","v0.3.67","v0.3.66","v0.3.65","v0.3.62","v0.3.61","v0.3.60","v0.3.59","v0.3.58","v0.3.57","v0.3.56","v0.3.55","v0.3.54","v0.3.53","v0.3.52","v0.3.51","v0.3.50","v0.3.49","v0.3.48","v0.3.47","v0.3.46","v0.3.45","v0.3.44","v0.3.43","v0.3.42","v0.3.41","v0.3.40","v0.3.39","v0.3.38","v0.3.37","v0.3.36","v0.3.35","v0.3.34","v0.3.33","v0.3.32","v0.3.31","v0.3.30","v0.3.29","v0.3.26","v0.3.25","v0.3.24","v0.3.23","v0.3.22","v0.3.21","v0.3.20","v0.3.19","v0.3.18","v0.3.17","v0.3.16","v0.3.15","v0.3.14","v0.3.13","v0.3.12","v0.3.11","v0.3.10","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.79","v0.2.78","v0.2.77","v0.2.76","v0.2.75","v0.2.74","v0.2.73","v0.2.72","v0.2.71","v0.2.70","v0.2.69","v0.2.68","v0.2.67","v0.2.66","v0.2.65","v0.2.64","v0.2.63","v0.2.62","v0.2.61","v0.2.60","v0.2.59","v0.2.58","v0.2.57","v0.2.56","v0.2.55","v0.2.54","v0.2.53","v0.2.52","v0.2.51","v0.2.50","v0.2.49","v0.2.48","v0.2.47","v0.2.46","v0.2.45","v0.2.44","v0.2.43","v0.2.41","v0.2.40","v0.2.39","v0.2.38","v0.2.37","v0.2.36","v0.2.35","v0.2.34","v0.2.33","v0.2.32","v0.2.31","v0.2.30","v0.2.29","v0.2.28","v0.2.27","v0.2.26","v0.2.25","v0.2.24","v0.2.23","v0.2.22","v0.2.21","v0.2.20","v0.2.19","v0.2.18","v0.2.17","v0.2.16","v0.2.15","v0.2.14","v0.2.13","v0.2.12","v0.2.11","v0.2.10","v0.2.9","v0.2.8","v0.2.7","v0.2.6","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7894.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}