eosphoros-ai DB-GPT: Code injection vulnerability (CVE-2026-123018)
A code injection vulnerability in the DB-GPT execute_code function allows for remote code execution, and public exploit code is available.
CVE search metadata
CVE search record: CVE-2026-123018. Severity: high. CVSS: 8.3. KEV: no. Product: DB-GPT (<= 0.8.2). Brief: eosphoros-ai DB-GPT: Code injection vulnerability (CVE-2026-123018). Brief link: https://feed.craftedsignal.io/briefs/2026-11-db-gpt-rce/
Triage facts
Revision 1- Applicability
- DB-GPT (<= 0.8.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 12:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A security flaw (CVE-2026-123018) has been identified in eosphoros-ai DB-GPT versions up to 0.8.2. The vulnerability resides in the execute_code function within the code_utils.py file of the CodeAction component. This flaw allows for code injection and can be initiated remotely. Public exploit code for this vulnerability is available. The project was notified via an issue report but has not yet responded.