Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-82527

R2R 3.6.6 SQL Injection via Retrieval Search Filter Key

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping to perform time-based and boolean-based data exfiltration from the application database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SciPhi-AI R2R

Default version status: unaffected

  • 0 to ≤ 3.6.6affected
  • 0 to ≤ 9c5a94d151f90876bd7eb860f300a8fd662dc481affected
pkg:github/SciPhi-AI/R2R

References