https://feed.craftedsignal.io/tags/cve-2026-123019/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 14:40:44 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-db-gpt-rce-ee2554b0/Thu, 05 Nov 2026 14:40:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-db-gpt-rce-ee2554b0/A weakness in the HuggingFace Adapter component of eosphoros-ai DB-GPT (up to 0.8.2) allows for the inclusion of functionality from an untrusted control sphere via the trust_remote_code argument.<p>A vulnerability exists in eosphoros-ai DB-GPT versions up to 0.8.2. The issue is located in the exec_module function within the hf_adapter.py file of the HuggingFace Adapter component. By manipulating the trust_remote_code argument, an attacker can trigger the inclusion of functionality from an untrusted control sphere. This attack can be performed remotely. Publicly available exploit material exists for this vulnerability, and the project has not yet responded to an early issue report regarding this problem.</p> mediumadvisoryvulnerabilitycve-2026-123019