eosphoros-ai DB-GPT: Vulnerability in HuggingFace Adapter (CVE-2026-123019)
A weakness in the HuggingFace Adapter component of eosphoros-ai DB-GPT (up to 0.8.2) allows for the inclusion of functionality from an untrusted control sphere via the trust_remote_code argument.
CVE search metadata
CVE search record: CVE-2026-123019. Severity: high. CVSS: 7.3. KEV: no. Product: DB-GPT (<= 0.8.2). Brief: eosphoros-ai DB-GPT: Vulnerability in HuggingFace Adapter (CVE-2026-123019). Brief link: https://feed.craftedsignal.io/briefs/2026-11-db-gpt-rce-ee2554b0/
Triage facts
Revision 1- Applicability
- DB-GPT (<= 0.8.2)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 14:40 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in eosphoros-ai DB-GPT versions up to 0.8.2. The issue is located in the exec_module function within the hf_adapter.py file of the HuggingFace Adapter component. By manipulating the trust_remote_code argument, an attacker can trigger the inclusion of functionality from an untrusted control sphere. This attack can be performed remotely. Publicly available exploit material exists for this vulnerability, and the project has not yet responded to an early issue report regarding this problem.