CVE-2026-51869

Received Received - Intake

DB-GPT Sandbox API LocalRuntime Code Execution

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: MITRE

Description

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-51869

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

DB-GPT v0.8.0 sandbox API has a flaw where it silently switches to LocalRuntime mode and executes code directly on the host system instead of within a secure sandbox environment.

Impact Analysis

This vulnerability allows arbitrary code execution on your host system, potentially leading to unauthorized access, data theft, or system compromise if malicious code is executed through the API.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and secure processing, as it enables unauthorized code execution which could lead to data breaches or loss of control over sensitive information.

Mitigation Strategies

Immediately upgrade DB-GPT to a version that patches this vulnerability. Disable the sandbox API if not required. Monitor for unauthorized code execution on the host system.

Hi! I’m here to help you understand CVE-2026-51869. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70