← CVE Radar
CVE-2026-123018eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
6.9 MEDIUMEPSS 0.50%Not in KEVNVD: Deferred
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.9 | MEDIUM | 4.0VulDB (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P |
| 5.5 | MEDIUM | 4.0VulDB (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P |
| 8.3 | HIGH | 3.1VulDB (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| 8.3 | HIGH | 3.1VulDB (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RC:C |
| 8.3 | HIGH | 3.0VulDB (CNA) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RC:C |
| 7.5 | HIGH | 2.0VulDB (CNA) | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| 7.5 | HIGH | 2.0VulDB (CNA) | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C |
Details
- CVE ID
- CVE-2026-123018
- Status
- Deferred
- Assigner (CNA)
- VulDB
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 21:18 UTC
Affected Products
As published by the CNA in the CVE record.
eosphoros-aiDB-GPT3 version ranges
- 0.8.0
- 0.8.1
- 0.8.2
References
- github.com https://github.com/eosphoros-ai/DB-GPT/
- github.com https://github.com/eosphoros-ai/DB-GPT/issues/3287
- github.com https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-codeaction-native-subprocess-llm-code-execution.md
- vuldb.com https://vuldb.com/cve/CVE-2026-123018
- vuldb.com https://vuldb.com/submit/1033094
- vuldb.com https://vuldb.com/vuln/431392
- vuldb.com https://vuldb.com/vuln/431392/cti