CVE-2026-123018: eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function executecode of the file codeutils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Event History
Frequently Asked Questions
Can an attacker exploit this without credentials or user interaction?
The supplied vector indicates no privileges and no user interaction are required. The attack can be initiated remotely.
Is public exploit code available?
Yes. The issue is flagged with a proof of concept, and the description states that an exploit has been publicly released.
What is known about the project's response?
The project was reportedly notified early through an issue report, but had not responded at the time of publication.