CVE-2026-123018
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2
- Risk score
- 55/100
- CVSS
- 8.3 v3.1
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be u…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.3 high
- Remotely exploitable without logging in
References
- https://github.com/eosphoros-ai/DB-GPT/
- https://github.com/eosphoros-ai/DB-GPT/issues/3287
- https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-codeaction-native-subprocess-llm-code-execution.md
- https://vuldb.com/cve/CVE-2026-123018
- https://vuldb.com/submit/1033094
- https://vuldb.com/vuln/431392
- https://vuldb.com/vuln/431392/cti
Original description
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Last activity 5 Nov 2026. Patch Forecast updates every hour.