CVE-2025-7894

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-7894

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7894.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-7894

Published

2025-07-20T14:02:07.096Z

Modified

2026-07-15T01:48:57.245874534Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection

Details

A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1. This issue affects the function generatesimplesql of the file backend/onyx/agents/agentsearch/kbsearch/nodes/a3generatesimple_sql.py of the component Chat Interface. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cwe_ids": [
        "CWE-74",
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7894.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.29.0"
                },
                {
                    "last_affected": "0.29.0"
                },
                {
                    "introduced": "0.29.1"
                },
                {
                    "last_affected": "0.29.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/onyx-dot-app/onyx

Affected ranges

Type

GIT

Repo

https://github.com/onyx-dot-app/onyx

Events

Introduced

Last affected

71712df3202bb6a31d20756cbcaf972b8bfac09e

Database specific

{
    "cpe": "cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.29.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*

0.4.5

confluence-patch-04.*

confluence-patch-04.1.2025

Other

experimental-1

highspot-special-tag

highspot-special-tag-2

nightly-latest-20240927

nightly-latest-20240928

nightly-latest-20240929

nightly-latest-20240930

nightly-latest-20241001

nightly-latest-20241002

nightly-latest-20241003

nightly-latest-20241004

nightly-latest-20241005

nightly-latest-20241006

nightly-latest-20241007

nightly-latest-20241008

nightly-latest-20241009

nightly-latest-20241010

nightly-latest-20241011

nightly-latest-20241012

nightly-latest-20241013

nightly-latest-20241014

nightly-latest-20241015

nightly-latest-20241016

nightly-latest-20241017

nightly-latest-20241018

nightly-latest-20241019

nightly-latest-20241020

nightly-latest-20241021

nightly-latest-20241022

nightly-latest-20241023

nightly-latest-20241024

nightly-latest-20241025

nightly-latest-20241026

nightly-latest-20241027

nightly-latest-20241028

nightly-latest-20241029

nightly-latest-20241030

nightly-latest-20241031

nightly-latest-20241101

nightly-latest-20241102

nightly-latest-20241103

nightly-latest-20241104

nightly-latest-20241105

nightly-latest-20241106

nightly-latest-20241107

nightly-latest-20241108

nightly-latest-20241109

nightly-latest-20241110

nightly-latest-20241111

nightly-latest-20241112

nightly-latest-20241113

nightly-latest-20241114

nightly-latest-20241115

nightly-latest-20241116

nightly-latest-20241117

nightly-latest-20241118

nightly-latest-20241119

nightly-latest-20241120

nightly-latest-20241121

nightly-latest-20241122

nightly-latest-20241123

nightly-latest-20241124

nightly-latest-20241125

nightly-latest-20241126

nightly-latest-20241127

nightly-latest-20241128

nightly-latest-20241129

nightly-latest-20241130

nightly-latest-20241201

nightly-latest-20241202

nightly-latest-20241203

nightly-latest-20241204

nightly-latest-20241205

nightly-latest-20241206

nightly-latest-20241207

nightly-latest-20241208

nightly-latest-20241209

nightly-latest-20241210

nightly-latest-20241211

nightly-latest-20241212

nightly-latest-20241213

nightly-latest-20241215

nightly-latest-20241216

nightly-latest-20241217

nightly-latest-20241218

nightly-latest-20241219

nightly-latest-20241220

nightly-latest-20241221

nightly-latest-20241222

nightly-latest-20241223

nightly-latest-20241224

nightly-latest-20241225

nightly-latest-20241226

nightly-latest-20241227

nightly-latest-20241228

nightly-latest-20241229

nightly-latest-20241230

nightly-latest-20241231

nightly-latest-20250101

nightly-latest-20250102

nightly-latest-20250103

nightly-latest-20250104

nightly-latest-20250105

nightly-latest-20250106

nightly-latest-20250107

nightly-latest-20250108

nightly-latest-20250109

nightly-latest-20250110

nightly-latest-20250111

nightly-latest-20250112

nightly-latest-20250113

nightly-latest-20250114

nightly-latest-20250115

nightly-latest-20250116

nightly-latest-20250117

nightly-latest-20250118

nightly-latest-20250119

nightly-latest-20250120

nightly-latest-20250121

nightly-latest-20250122

nightly-latest-20250123

nightly-latest-20250124

nightly-latest-20250125

nightly-latest-20250126

nightly-latest-20250127

nightly-latest-20250128

nightly-latest-20250129

nightly-latest-20250130

nightly-latest-20250131

nightly-latest-20250201

nightly-latest-20250202

nightly-latest-20250203

nightly-latest-20250204

nightly-latest-20250205

nightly-latest-20250206

nightly-latest-20250207

nightly-latest-20250208

nightly-latest-20250209

nightly-latest-20250210

nightly-latest-20250211

nightly-latest-20250212

nightly-latest-20250212-early

nightly-latest-20250213

nightly-latest-20250214

nightly-latest-20250215

nightly-latest-20250216

nightly-latest-20250217

nightly-latest-20250218

nightly-latest-20250219

nightly-latest-20250220

nightly-latest-20250221

nightly-latest-20250222

nightly-latest-20250223

nightly-latest-20250224

nightly-latest-20250225

nightly-latest-20250226

nightly-latest-20250227

nightly-latest-20250228

nightly-latest-20250301

nightly-latest-20250302

nightly-latest-20250303

nightly-latest-20250304

nightly-latest-20250305

nightly-latest-20250306

nightly-latest-20250307

nightly-latest-20250308

nightly-latest-20250309

nightly-latest-20250310

nightly-latest-20250311

nightly-latest-20250312

nightly-latest-20250313

nightly-latest-20250314

nightly-latest-20250315

nightly-latest-20250316

nightly-latest-20250317

nightly-latest-20250318

nightly-latest-20250319

nightly-latest-20250320

nightly-latest-20250321

nightly-latest-20250322

nightly-latest-20250323

nightly-latest-20250324

nightly-latest-20250325

nightly-latest-20250326

nightly-latest-20250327

nightly-latest-20250328

nightly-latest-20250329

nightly-latest-20250330

nightly-latest-20250331

nightly-latest-20250402

nightly-latest-20250403

nightly-latest-20250404

nightly-latest-20250405

nightly-latest-20250406

nightly-latest-20250407

nightly-latest-20250408

nightly-latest-20250409

nightly-latest-20250410

nightly-latest-20250411

nightly-latest-20250412

nightly-latest-20250413

nightly-latest-20250414

nightly-latest-20250415

nightly-latest-20250416

nightly-latest-20250417

nightly-latest-20250418

nightly-latest-20250419

nightly-latest-20250420

nightly-latest-20250421

nightly-latest-20250422

nightly-latest-20250423

nightly-latest-20250424

nightly-latest-20250425

nightly-latest-20250426

nightly-latest-20250427

nightly-latest-20250428

nightly-latest-20250429

nightly-latest-20250430

nightly-latest-20250501

nightly-latest-20250502

nightly-latest-20250503

nightly-latest-20250504

nightly-latest-20250505

nightly-latest-20250506

nightly-latest-20250507

nightly-latest-20250508

nightly-latest-20250509

nightly-latest-20250510

nightly-latest-20250511

nightly-latest-20250512

nightly-latest-20250513

nightly-latest-20250514

nightly-latest-20250515

nightly-latest-20250516

nightly-latest-20250517

nightly-latest-20250518

nightly-latest-20250519

nightly-latest-20250520

nightly-latest-20250521

notion-patch-20241022

teams-improvements

vespa-more-retries

nightly-latest-20250321-patch.*

nightly-latest-20250321-patch.1

nightly-latest-20250331.*

nightly-latest-20250331.1

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.1.9

v0.10.0-beta.1

v0.10.0-beta.2

v0.10.0-beta.3

v0.10.0-beta.4

v0.10.0-beta.5

v0.10.0-beta.6

v0.10.0-cloud.beta.10

v0.10.0-cloud.beta.5

v0.10.0-cloud.beta.6

v0.10.0-cloud.beta.7

v0.10.0-cloud.beta.8

v0.10.0-cloud.beta.9

v0.11.0-beta.1

v0.11.0-cloud.beta.1

v0.11.0-cloud.beta.5

v0.11.0-cloud.beta.6

v0.12.0-beta.1

v0.12.0-cloud.beta.0

v0.12.0-cloud.beta.16

v0.12.0-cloud.beta.17

v0.13.0-beta.1

v0.13.0-cloud.beta.2

v0.14.0-beta.1

v0.14.0-cloud.beta.0

v0.15.0-beta.1

v0.15.0-cloud.beta.1

v0.15.0-cloud.beta.12

v0.15.0-cloud.beta.13

v0.15.0-cloud.beta.15

v0.15.0-cloud.beta.17

v0.15.0-cloud.beta.19

v0.15.0-cloud.beta.2

v0.15.0-cloud.beta.20

v0.15.0-cloud.beta.21

v0.15.0-cloud.beta.23

v0.15.0-cloud.beta.4

v0.15.0-cloud.beta.7

v0.15.0-cloud.beta.8

v0.16.0-beta.1

v0.18.0

v0.18.0-beta.1

v0.18.0-beta.2

v0.18.0-cloud.1

v0.18.0-cloud.10

v0.18.0-cloud.11

v0.18.0-cloud.12

v0.18.0-cloud.13

v0.18.0-cloud.15

v0.18.0-cloud.19

v0.18.0-cloud.20

v0.18.0-cloud.22

v0.18.0-cloud.23

v0.18.0-cloud.3

v0.18.0-cloud.31

v0.18.0-cloud.34

v0.18.0-cloud.6

v0.18.0-cloud.8

v0.18.0-cloud.9

v0.19.0-beta.1

v0.19.0-cloud.10

v0.19.0-cloud.13

v0.19.0-cloud.15

v0.19.0-cloud.18

v0.19.0-cloud.26

v0.19.0-cloud.39

v0.19.0-cloud.41

v0.19.0-cloud.45

v0.19.0-cloud.58

v0.19.0-cloud.59

v0.19.0-cloud.62

v0.19.0-cloud.65

v0.19.0-cloud.66

v0.19.0-cloud.67

v0.19.0-cloud.68

v0.19.0-cloud.71

v0.19.0-cloud.73

v0.19.0-cloud.74

v0.19.0-cloud.75

v0.2.0

v0.2.1

v0.2.10

v0.2.11

v0.2.12

v0.2.13

v0.2.14

v0.2.15

v0.2.16

v0.2.17

v0.2.18

v0.2.19

v0.2.2

v0.2.20

v0.2.21

v0.2.22

v0.2.23

v0.2.24

v0.2.25

v0.2.26

v0.2.27

v0.2.28

v0.2.29

v0.2.3

v0.2.30

v0.2.31

v0.2.32

v0.2.33

v0.2.34

v0.2.35

v0.2.36

v0.2.37

v0.2.38

v0.2.39

v0.2.4

v0.2.40

v0.2.41

v0.2.43

v0.2.44

v0.2.45

v0.2.46

v0.2.47

v0.2.48

v0.2.49

v0.2.5

v0.2.50

v0.2.51

v0.2.52

v0.2.53

v0.2.54

v0.2.55

v0.2.56

v0.2.57

v0.2.58

v0.2.59

v0.2.6

v0.2.60

v0.2.61

v0.2.62

v0.2.63

v0.2.64

v0.2.65

v0.2.66

v0.2.67

v0.2.68

v0.2.69

v0.2.7

v0.2.70

v0.2.71

v0.2.72

v0.2.73

v0.2.74

v0.2.75

v0.2.76

v0.2.77

v0.2.78

v0.2.79

v0.2.8

v0.2.9

v0.20.0

v0.20.0-beta.1

v0.20.0-cloud.28

v0.20.0-cloud.31

v0.20.0-cloud.35

v0.20.0-cloud.36

v0.20.0-cloud.41

v0.20.0-cloud.5

v0.20.0-cloud.57

v0.20.0-cloud.6

v0.20.0-cloud.73

v0.20.0-cloud.76

v0.20.0-cloud.84

v0.21.0

v0.21.0-beta.1

v0.22.0-beta.1

v0.23.0

v0.23.0-beta.1

v0.23.0-cloud.0

v0.23.0-cloud.1

v0.23.0-cloud.3

v0.23.0-cloud.4

v0.24.0-beta.1

v0.24.0-cloud.1

v0.24.0-cloud.23

v0.24.0-cloud.24

v0.24.0-cloud.25

v0.24.0-cloud.26

v0.24.0-cloud.27

v0.24.0-cloud.29

v0.24.0-cloud.30

v0.24.0-cloud.31

v0.24.0-cloud.32

v0.24.0-cloud.33

v0.24.0-cloud.45

v0.24.0-cloud.46

v0.24.0-cloud.47

v0.24.0-cloud.48

v0.24.0-cloud.49

v0.24.0-cloud.5

v0.24.0-cloud.50

v0.24.0-cloud.51

v0.24.0-cloud.55

v0.24.0-cloud.56

v0.24.0-cloud.58

v0.24.0-cloud.6

v0.24.0-cloud.60

v0.24.0-cloud.61

v0.24.0-cloud.63

v0.24.0-cloud.64

v0.25.0-beta.1

v0.26.0

v0.26.0-beta.2

v0.27.0

v0.27.0-beta.1

v0.28.0

v0.28.0-beta.1

v0.28.0-candidate

v0.29.0

v0.29.0-beta.1

v0.29.1

v0.3.0

v0.3.1

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.16

v0.3.17

v0.3.18

v0.3.19

v0.3.2

v0.3.20

v0.3.21

v0.3.22

v0.3.23

v0.3.24

v0.3.25

v0.3.26

v0.3.29

v0.3.3

v0.3.30

v0.3.31

v0.3.32

v0.3.33

v0.3.34

v0.3.35

v0.3.36

v0.3.37

v0.3.38

v0.3.39

v0.3.4

v0.3.40

v0.3.41

v0.3.42

v0.3.43

v0.3.44

v0.3.45

v0.3.46

v0.3.47

v0.3.48

v0.3.49

v0.3.5

v0.3.50

v0.3.51

v0.3.52

v0.3.53

v0.3.54

v0.3.55

v0.3.56

v0.3.57

v0.3.58

v0.3.59

v0.3.6

v0.3.60

v0.3.61

v0.3.62

v0.3.65

v0.3.66

v0.3.67

v0.3.68

v0.3.69

v0.3.7

v0.3.70

v0.3.71

v0.3.72

v0.3.73

v0.3.74

v0.3.75

v0.3.76

v0.3.77

v0.3.78

v0.3.79

v0.3.8

v0.3.80

v0.3.81

v0.3.82

v0.3.85

v0.3.86

v0.3.87

v0.3.88

v0.3.89

v0.3.9

v0.3.90

v0.3.91

v0.3.92

v0.3.93

v0.3.94

v0.3.95

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.14

v0.4.15

v0.4.16

v0.4.17

v0.4.18

v0.4.19

v0.4.2

v0.4.20

v0.4.21

v0.4.22

v0.4.23

v0.4.25

v0.4.26

v0.4.27

v0.4.28

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.13

v0.5.14

v0.5.15

v0.5.16

v0.5.17

v0.5.18

v0.5.19

v0.5.2

v0.5.20

v0.5.21

v0.5.22

v0.5.23

v0.5.24

v0.5.25

v0.5.26

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0-beta.1

v0.7.0-beta.1

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.8.0-beta.1

v0.9.0

v0.9.0-beta.1

v0.9.0-beta.2

v0.9.0-beta.3

v0.9.0-beta.4

v0.9.0-beta.5

v0.9.0-beta.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7894.json"