{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-123019/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eosphoros_ai:db_gpt:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-123019"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DB-GPT (\u003c= 0.8.2)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","cve-2026-123019"],"_cs_type":"advisory","_cs_vendors":["eosphoros-ai"],"content_html":"\u003cp\u003eA vulnerability exists in eosphoros-ai DB-GPT versions up to 0.8.2. The issue is located in the exec_module function within the hf_adapter.py file of the HuggingFace Adapter component. By manipulating the trust_remote_code argument, an attacker can trigger the inclusion of functionality from an untrusted control sphere. This attack can be performed remotely. Publicly available exploit material exists for this vulnerability, and the project has not yet responded to an early issue report regarding this problem.\u003c/p\u003e\n","date_modified":"2026-11-05T14:40:44Z","date_published":"2026-11-05T14:40:44Z","id":"https://feed.craftedsignal.io/briefs/2026-11-db-gpt-rce-ee2554b0/","summary":"A weakness in the HuggingFace Adapter component of eosphoros-ai DB-GPT (up to 0.8.2) allows for the inclusion of functionality from an untrusted control sphere via the trust_remote_code argument.","title":"eosphoros-ai DB-GPT: Vulnerability in HuggingFace Adapter (CVE-2026-123019)","url":"https://feed.craftedsignal.io/briefs/2026-11-db-gpt-rce-ee2554b0/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-123019","version":"https://jsonfeed.org/version/1.1"}