CVE-2025-7894 is a medium (CVSS 6.3) SQL injection in Onyx (Onyx up to 0.29.1). The record names no fixed version, so plan on isolating or replacing it. Do not expose the product to untrusted networks until you have confirmed a fix.
What's affected
The record lists Onyx up to 0.29.1 as affected. The vulnerable code is in backend/onyx/agents/agent_search/kb_search/nodes/a3_generate_simple_sql.py.
No fixed version is named in the record or in the article I read. Check the Onyx releases for anything newer than 0.29.1.
This is not the usual form field case. A write-up on cnblogs says the generate_simple_sql function builds SQL from text produced by a language model and runs it without proper sanitization, and that its guardrail does not stop SELECT statements that pull data out. The author says it is reachable through the chat endpoint and the knowledge graph tool. The suggested fix is to have the model produce a structured intent and let code build parameterized queries.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, a score of 6.3. The record says the vendor was contacted early and did not respond in any way.
The record also says the exploit has been disclosed to the public and may be used. That is not the same as confirmed attacks: this CVE is not in CISA's Known Exploited Vulnerabilities catalog (the record's kev flag is false).
How to check if you're exposed
For Onyx, check the running version and compare it to 0.29.1 and the project's newest release:
docker ps --format "{{.Image}}" | grep -i onyx
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Confirm whether you run Onyx and in which version.
- Take it off any internet facing host, or put it behind authentication at the web server or VPN, until a fix exists.
- Check the project's releases for a newer release. No fix is named in the record.
- Put a WAF rule in front of the a3_generate_simple_sql.py endpoint as a stopgap. A WAF reduces risk but does not fix the code.
- If you maintain a fork, do not let model written SQL run directly. Have the model produce structured intent and build parameterized queries in code, as the article suggests.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-74 (injection), CWE-89 (SQL injection). The twist in Onyx is that the SQL is written by a language model from user text, so the model's output has to be treated like any other untrusted input. A guardrail that tests whether the query runs is not a guardrail that tests whether the query is safe.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2025-7894?
The record does not name a fixed version, and for PAD CMS CERT Polska says none will be published. Treat the product as unpatched, reduce its exposure and check the vendor or project site for news.
Is CVE-2025-7894 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. The record does say the exploit has been disclosed to the public, so assume attackers can find it.
Sources
- Safeguard Gold entry for CVE-2025-7894
- Write-up on cnblogs (Chinese)
- NVD record data for CVE-2025-7894, published 2025-07-20, source cna@vuldb.com
Last reviewed: 18 October 2026.
