CVE-2026-51869

Deferred Deferred - Pending Action

DB-GPT Sandbox API LocalRuntime Code Execution

Publication date: 2026-09-30

Last updated on: 2026-10-07

Assigner: MITRE

Description

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51869

Affected Vendors & Products

Vendor	Product	Version / Range
eosphoros-ai	db-gpt	0.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

DB-GPT v0.8.0 sandbox API has a flaw where it silently switches to LocalRuntime mode and executes code directly on the host system instead of within a secure sandbox environment.

Detection Guidance

Check for the presence of /tmp/dbgpt_web_unsandboxed.txt containing 'UNSANDBOXED_EXECUTION_VIA_WEB' to confirm unsandboxed execution. Inspect runtime_factory.py for LocalRuntime fallback logic in RuntimeFactory.create(). Verify SANDBOX_RUNTIME environment variable settings and container runtime availability.

Impact Analysis

This vulnerability allows arbitrary code execution on your host system, potentially leading to unauthorized access, data theft, or system compromise if malicious code is executed through the API.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and secure processing, as it enables unauthorized code execution which could lead to data breaches or loss of control over sensitive information.

Mitigation Strategies

Immediately upgrade DB-GPT to a version that patches this vulnerability. Disable the sandbox API if not required. Monitor for unauthorized code execution on the host system.

Hi! I’m here to help you understand CVE-2026-51869. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70