[Security]: security issues report

[360AlphaLab]

Hi maintainers,

I have identified two potential security issues in Chat2DB and would like to report them responsibly.

I could not find a SECURITY.md file or a documented vulnerability disclosure process for this repository. I also do not want to disclose technical details, reproduction steps, or proof-of-concept information publicly in a GitHub issue.

Could you please let me know the preferred private channel for reporting security issues, or enable GitHub private vulnerability reporting for this repository?

I can provide the following privately:

affected files and versions/commit ranges
impact assessment and severity
reproduction steps
proof-of-concept evidence
recommended remediation options
Thanks.

[360AlphaLab]

Hi maintainers,

I’m following up with a brief, non-sensitive summary for one of the security issues so you can triage it more easily.

One issue I found is a potential remote code execution vulnerability related to Chat2DB’s custom JDBC driver loading workflow. In short, a user-controlled JDBC driver package and driver class can be introduced through the normal driver management functionality, and later loaded by the server-side Java process. If abused, this may allow arbitrary code execution with the privileges of the Chat2DB process.

Impact summary:

• Vulnerability type: unsafe dynamic class loading / remote code execution
• Affected area: custom JDBC driver upload, registration, and connection testing/loading workflow
• Impact: arbitrary code execution on the Chat2DB host or container
• Tested version: Chat2DB v3.4.1
• Potentially affected deployments: server deployments where users can manage JDBC drivers, and desktop/local deployments using the same driver-loading logic
• Required condition: access to the relevant Chat2DB functionality; I can provide the exact preconditions privately

I’m intentionally not posting endpoint names, source locations, reproduction steps, payloads, or proof-of-concept details publicly here.

I can provide the full report privately, including the affected code path, version/commit analysis, impact assessment, reproduction evidence, and suggested remediation.

Could you please let me know whether you prefer a private disclosure channel, GitHub private vulnerability reporting, or whether you want me to continue with a sanitized technical report in this issue?