CVE-2026-123020
Deferred Deferred - Pending Action

Template Injection in DB-GPT via Jinja2 Skill Handler

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.get_prompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claude_skill/__init__.py of the component Jinja2 Template Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is sufficient to fix this issue. The identifier of the patch is a9e7a3c026d114fcfb4ffe3eaf78851a636ded16. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123020
EUVD
EUVD-2026-117434

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
eosphoros-ai DB-GPT 0.8.0
eosphoros-ai DB-GPT 0.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CWE-791 The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Template Injection (SSTI) in DB-GPT versions up to 0.8.1. It occurs in the Jinja2 template handler, specifically in the FileBasedSkill.get_prompt function. Attackers can exploit this by uploading a malicious SKILL.md file containing Jinja2 payloads. When processed, these payloads execute arbitrary code on the server before any AI model interaction. The root cause is the use of unsafe Jinja2 template rendering without sandboxing.

Detection Guidance

Check if DB-GPT version 0.8.1 or earlier is installed by running: pip show dbgpt or checking the version in the application interface. Inspect SKILL.md files for malicious Jinja2 payloads, such as those containing __subclasses__ or system calls. Monitor network traffic for unauthorized POST requests to /api/v1/skills/upload or /api/v1/chat/react-agent endpoints.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary commands on the server hosting DB-GPT. They can create files, modify data, or take control of the system. Since the attack happens during system prompt rendering, it occurs before any LLM processing, making it highly dangerous. The vulnerability affects default installations and can be exploited remotely.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system security. GDPR requires protecting personal data and ensuring system integrity, while HIPAA mandates safeguarding protected health information. The RCE risk could lead to unauthorized data access, modification, or exfiltration, resulting in regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade DB-GPT to version 0.8.2 or later immediately using pip install --upgrade dbgpt. Remove or sanitize any untrusted SKILL.md files. Restrict access to vulnerable endpoints by implementing proper authentication and authorization. Apply the patch commit a9e7a3c026d114fcfb4ffe3eaf78851a636ded16 if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123020. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...