CVE-2026-7023 | ByteDance coze-studio up to 0.5.1 databaseTool database_impl.go ExecuteSQL sql injection

A vulnerability marked as critical has been reported in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection.

This vulnerability is identified as CVE-2026-7023. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.