AIKIDO-2026-562088

TL;DR

SQLChatAgent enforces its SELECT-only statement allowlist by inspecting only the top-level parsed node of a query. Data-modifying CTEs such as WITH x AS (DELETE ...) SELECT ... and the SELECT ... INTO form parse with a top-level Select node, so they are accepted as read-only while the database still executes the embedded write. Under the default read-only policy, input that influences the generated SQL can insert, update, delete, or create data using an ordinary write-capable role. The fix walks the full parse tree for nested write nodes and rejects any statement whose parse tree contains a data-modifying operation outside the allowlist.