{"id":"CVE-2024-10835","kind":"vulnerability","aliases":["CVE-2024-10835","GHSA-qccg-9m4q-xfm6"],"related":[],"title":"DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users","description":"In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).","summary":"DB-GPT's web API endpoint POST /api/v1/editor/sql/run runs arbitrary SQL with no access control. An attacker can use DuckDB SQL to write arbitrary files on the server, which can lead to remote code execution.","severity":"critical","cvss":9.8,"epss":0.01183,"exploited":false,"exploited_at":null,"products":[{"name":"dbgpt","fixed":["0.7.1"],"affected":"< 0.7.1","ecosystem":"pypi"},{"name":"dbgpt db-gpt","fixed":[],"affected":"= 0.6.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-tooling","cwe-89","dbgpt","pypi","python","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- Check the installed version with `pip show dbgpt` and look for anything below `0.7.1`.\n- Check whether the web server is reachable from untrusted networks and whether `/api/v1/editor/sql/run` responds.","fix":"- Upgrade the `dbgpt` PyPI package to `0.7.1` or later.\n- Until upgraded, block `/api/v1/editor/sql/run` at the reverse proxy or firewall.","status":"open","published_at":"2025-03-20T10:15:20+00:00","first_seen_at":"2026-10-27T16:30:45+00:00","triaged_at":"2026-10-27T16:31:53+00:00","updated_at":"2026-10-27T16:33:07+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T16:31:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `dbgpt` PyPI package to `0.7.1` or later.\n- Until upgraded, block `/api/v1/editor/sql/run` at the reverse proxy or firewall.","reach":"internet","title":"DB-GPT: unauthenticated SQL endpoint lets attackers write arbitrary files","impact":"high","summary":"DB-GPT's web API endpoint POST /api/v1/editor/sql/run runs arbitrary SQL with no access control. An attacker can use DuckDB SQL to write arbitrary files on the server, which can lead to remote code execution.","category":"ai-tooling","nicknames":[],"who_cares":["python","pypi","dbgpt","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker writes arbitrary files on server, possibly achieving remote code execution.","analyst_note":"Confirm whether the editor SQL endpoint is enabled by default in dbgpt 0.7.x and whether the web server exposes it; see GHSA-qccg-9m4q-xfm6.","how_to_check":"- Check the installed version with `pip show dbgpt` and look for anything below `0.7.1`.\n- Check whether the web server is reachable from untrusted networks and whether `/api/v1/editor/sql/run` responds.","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams running DB-GPT's web server from the pypi package before 0.7.1 are exposed, especially if the server is reachable beyond localhost. The sources do not say whether the endpoint is enabled in default configuration. Installs that only run the library in code without the web server are likely not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000653,"input_tokens":3410,"output_tokens":624,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10835':15A,23A '-2024':14A,22A '-89':33B '/api/v1/editor/sql/run':48B,87C '/db-gpt':80C '9m4q':19A 'access':54B,96C 'ai':30B,79C 'ai-tool':29B 'allow':88C 'api':45B,85C 'arbitrari':50B,64B,91C,107C,117C 'attack':9A,57B,104C 'code':74B,131C 'control':55B,97C 'cve':13A,21A 'cwe':32B 'db':2A,27A,41B 'db-gpt':1A,26A,40B 'dbgpt':24A,25A,34B 'duckdb':60B,111C 'enabl':113C 'endpoint':46B 'eosphoro':78C 'eosphoros-ai':77C 'execut':75B,89C,132C 'exploit':102C 'file':65B,108C,118C,123C 'ghsa':17A 'ghsa-qccg-9m4q-xfm6':16A 'gpt':3A,28A,42B 'host':39B 'inject':8A 'lead':71B,128C 'perform':106C 'post':47B,86C 'potenti':127C 'pypi':35B 'python':36B 'qccg':18A 'queri':93C 'rce':133C 'remot':73B,130C 'run':49B 'self':38B 'self-host':37B 'server':68B 'sql':7A,51B,61B,92C,112C 'system':124C 'tool':31B 'unauthent':11A 'use':59B,110C 'user':12A 'v0.6.0':82C 'version':81C 'victim':121C 'vulner':5A,99C 'web':44B,84C 'without':94C 'write':63B,109C,116C 'xfm6':20A","nicknames":[],"mitigations":[],"who_affected":"Teams running DB-GPT's web server from the pypi package before 0.7.1 are exposed, especially if the server is reachable beyond localhost. The sources do not say whether the endpoint is enabled in default configuration. Installs that only run the library in code without the web server are likely not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:20+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qccg-9m4q-xfm6","url":"https://github.com/advisories/GHSA-qccg-9m4q-xfm6","severity":"critical","published_at":"2025-03-20T12:32:40+00:00","modified_at":"2026-10-27T16:26:21+00:00","first_seen_at":"2026-10-27T16:30:45+00:00","fetched_at":"2026-10-27T16:30:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-10835","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10835","severity":null,"published_at":"2025-03-20T10:15:20+00:00","modified_at":"2026-06-17T06:56:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}