{"id":"CVE-2026-123018","kind":"vulnerability","aliases":["CVE-2026-123018"],"related":[],"title":"DB-GPT: code injection in CodeAction lets remote attackers run code","description":"A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"DB-GPT CodeAction (execute_code in code_utils.py) runs LLM-generated code blocks natively in the server process. Per the reporter's GitHub issue #3287 (open, no maintainer reply), the official Docker image skips the sandbox and the default API needs no authentication, so a remote attacker can get code run. The reporter demonstrated a file write. No fixed version exists; v0.8.2 is the latest release. Mitigation suggested by the reporter: restrict port 5670, avoid CodeEngineer/CodeAction apps, and put an authenticating proxy in front.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DB-GPT","fixed":[],"affected":"<= 0.8.2","ecosystem":"pip"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","db-gpt","docker","python","self-hosted"],"not_affected_if":["auth-required","network-restricted","newer-version"],"how_to_check":"- Check the DB-GPT version: 0.8.2 (latest release, 26 Aug 2026) and earlier are listed as affected; the reporter tested 0.8.1 on the official Docker image.\n- Check whether port 5670 is reachable from untrusted networks and whether api_keys is empty in your config (the default, per the reporter, means no authentication).\n- Check for apps using the CodeEngineer agent (CodeAction), and for 'EXECUTING CODE BLOCK' lines or tmp_code_* scripts in the server logs.","fix":null,"status":"open","published_at":"2026-11-05T12:17:49+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","triaged_at":"2026-11-05T12:40:09+00:00","updated_at":"2026-11-05T12:41:23+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-05T12:40:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DB-GPT: code injection in CodeAction lets remote attackers run code","impact":"high","summary":"DB-GPT, an open-source AI application framework, has a flaw in the execute_code function of CodeAction in code_utils.py that allows code injection. A remote attacker who can send crafted input can get the server to run code of their choosing, and a public exploit has been released.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["db-gpt","ai-agents","self-hosted","python"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the DB-GPT server.","analyst_note":"Confirm whether a fixed version exists and whether the CodeAction path needs auth or a special feature; check the NVD entry and the upstream DB-GPT repository.","how_to_check":"- Check whether the DB-GPT version in use is `0.8.2` or earlier.\n- Look for the `CodeAction` component and `execute_code` in `code_utils.py` in the deployed code.\n- unknown whether the sources give a configuration check beyond the version.","plain_action":"","needs_analyst":true,"not_affected_if":["newer-version"],"who_is_affected":"Teams running DB-GPT up to version 0.8.2 where the CodeAction component is reachable with attacker-controlled input. The sources do not say which deployment settings or features are required to reach the flaw. The project has not responded to the report, so no fixed version is stated.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4251,"output_tokens":575,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version exists and whether the CodeAction path needs auth or a special feature; check the NVD entry and the upstream DB-GPT repository.","search":"'-123018':15A,18A '-2026':14A,17A '0.8.2':136C '3287':61B '5670':110B 'affect':139C 'agent':24B 'ai':23B,26B,130C 'ai-ag':22B 'ai-tool':25B 'api':76B 'app':113B 'attack':10A,83B,160C,178C 'authent':79B,117B 'avoid':111B 'block':49B 'code':4A,12A,41B,48B,86B,143C,157C 'code_utils.py':43B,147C 'codeact':7A,39B,151C 'codeengineer/codeaction':112B 'compon':150C 'cve':13A,16A 'db':2A,20A,29B,37B,132C 'db-gpt':1A,19A,28B,36B,131C 'default':75B 'demonstr':90B 'discov':126C 'docker':31B,68B 'earli':186C 'eosphoro':129C 'eosphoros-ai':128C 'execut':40B,142C 'exist':97B 'exploit':166C 'file':92B,146C 'fix':95B 'flaw':123C 'front':120B 'function':141C 'generat':47B 'get':85B 'github':59B 'gpt':3A,21A,30B,38B,133C 'host':35B 'imag':69B 'inform':182C 'initi':163C 'inject':5A,158C 'issu':60B,138C,189C 'latest':101B 'let':8A 'llm':46B 'llm-gener':45B 'maintain':64B 'manipul':154C 'may':174C 'mitig':103B 'nativ':50B 'need':77B 'offici':67B 'open':62B 'per':55B 'perform':152C 'port':109B 'problem':185C 'process':54B 'project':180C 'proxi':118B 'public':172C 'put':115B 'python':32B 'releas':102B,169C 'remot':9A,82B,164C 'repli':65B 'report':57B,89B,107B,190C 'respond':194C 'restrict':108B 'result':155C 'run':11A,44B,87B 'sandbox':72B 'secur':122C 'self':34B 'self-host':33B 'server':53B 'skip':70B 'suggest':104B 'tool':27B 'use':176C 'v0.8.2':98B 'version':96B 'write':93B 'yet':195C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted DB-GPT up to 0.8.2 where the API is reachable by untrusted users. The reporter says the default config has no authentication (api_keys empty, port 5670 on 0.0.0.0), so someone can create a CodeEngineer agent app and make the LLM emit code that CodeAction runs inside the server process. In the official Docker image the built-in sandbox is skipped because of a /.dockerenv check. Deployments behind an authenticating proxy or on a private network are much less exposed. This comes from the reporter's issue; the maintainers have not confirmed it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["dbgpt"],"ptokens":["db","gpt"],"labels":["aiagents","aitooling","dbgpt","docker","high","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123018","severity":null,"published_at":"2026-11-05T12:17:49+00:00","modified_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","fetched_at":"2026-11-05T12:38:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123018:1777","url":"https://github.com/eosphoros-ai/DB-GPT/issues/3287","severity":null,"published_at":"2026-11-05T12:41:23+00:00","modified_at":"2026-11-05T12:41:23+00:00","first_seen_at":"2026-11-05T12:41:23+00:00","fetched_at":"2026-11-05T12:41:23+00:00","note":"No fix: latest release v0.8.2 (releases page), issue #3287 open with no maintainer response. Matching the CVE to #3287 is likely but not stated by NVD. Nothing verified: no maintainer/vendor statement exists, only the reporter's issue. Exploited-in-the-wild not shown; PoC steps are in the issue.","cites":["https://github.com/eosphoros-ai/DB-GPT/issues/3287","https://github.com/eosphoros-ai/DB-GPT/releases"]}],"documents":[{"id":76191,"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3287","title":"DB-GPT #3287: CodeAction executes LLM-generated code natively (unauthenticated RCE)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1306,"url":"https://github.com/eosphoros-ai/DB-GPT/releases","title":"DB-GPT releases (latest v0.8.2)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}