Live › vulnerability › CVE-2024-10835
Go to dashboardDB-GPT's web API endpoint POST /api/v1/editor/sql/run runs arbitrary SQL with no access control. An attacker can use DuckDB SQL to write arbitrary files on the server, which can lead to remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:30 UTC, 0h before NVD. All times on this page are UTC.
Teams running DB-GPT's web server from the pypi package before 0.7.1 are exposed, especially if the server is reachable beyond localhost. The sources do not say whether the endpoint is enabled in default configuration. Installs that only run the library in code without the web server are likely not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| dbgpt | pypi | < 0.7.1 | 0.7.1 |
| dbgpt db-gpt | vendor | = 0.6.0 | – |
pip show dbgpt and look for anything below 0.7.1./api/v1/editor/sql/run responds.dbgpt PyPI package to 0.7.1 or later./api/v1/editor/sql/run at the reverse proxy or firewall.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).
This page as .md · .json · in your agent: get_signal("CVE-2024-10835")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.