CVE-2026-123018
Deferred Deferred - Pending Action

Code Injection in DB-GPT via CodeAction

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123018
EUVD
EUVD-2026-117405

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
eosphoros-ai DB-GPT 0.8.0
eosphoros-ai DB-GPT 0.8.1
eosphoros-ai DB-GPT 0.8.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123018 is a critical vulnerability in DB-GPT up to version 0.8.2. It allows unauthenticated remote code execution due to improper handling of LLM-generated code in the CodeAction component. The flaw occurs because code blocks are executed natively via subprocess.run without sandboxing or authentication, even when running in a Docker container. Attackers can exploit this by creating an agent app and inducing the LLM to output malicious code through unauthenticated API calls.

Detection Guidance

Check for unauthorized subprocess activity or native code execution attempts in DB-GPT logs. Monitor for suspicious API calls to endpoints like /api/v1/app/create or /api/v1/chat/completions. Verify if the /.dockerenv file exists in DB-GPT containers and if code_utils.py executes commands via subprocess.run without sandboxing.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the DB-GPT server remotely without authentication. They can gain full access to the container, steal sensitive data like LLM API keys or environment variables, access databases, and potentially move laterally within the network. The exploit requires no user interaction beyond sending crafted API requests.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires strict access controls and data protection measures; this flaw enables unauthorized code execution and data access. HIPAA mandates safeguards for protected health information; remote code execution could expose such data. Organizations using affected DB-GPT versions risk non-compliance due to inadequate security controls.

Mitigation Strategies

Restrict network access to port 5670, disable CodeEngineer-based agents, and avoid using the CodeAction component. Implement authentication for API endpoints and monitor for subprocess activity. Consider isolating DB-GPT containers from other systems until a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...