---
id: "CVE-2026-123018"
kind: "vulnerability"
aliases: ["CVE-2026-123018"]
title: "DB-GPT: code injection in CodeAction lets remote attackers run code"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "DB-GPT", "fixed": [], "affected": "<= 0.8.2", "ecosystem": "pip"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "db-gpt", "docker", "python", "self-hosted"]
not_affected_if: ["auth-required", "network-restricted", "newer-version"]
published_at: "2026-11-05T12:17:49+00:00"
first_seen_at: "2026-11-05T12:38:47+00:00"
updated_at: "2026-11-05T12:41:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123018", "first_seen_at": "2026-11-05T12:38:47+00:00"}, {"source": "analyst", "url": "https://github.com/eosphoros-ai/DB-GPT/issues/3287", "first_seen_at": "2026-11-05T12:41:23+00:00", "cites": ["https://github.com/eosphoros-ai/DB-GPT/issues/3287", "https://github.com/eosphoros-ai/DB-GPT/releases"]}]
exploit_sources: []
---

# DB-GPT: code injection in CodeAction lets remote attackers run code

DB-GPT CodeAction (execute_code in code_utils.py) runs LLM-generated code blocks natively in the server process. Per the reporter's GitHub issue #3287 (open, no maintainer reply), the official Docker image skips the sandbox and the default API needs no authentication, so a remote attacker can get code run. The reporter demonstrated a file write. No fixed version exists; v0.8.2 is the latest release. Mitigation suggested by the reporter: restrict port 5670, avoid CodeEngineer/CodeAction apps, and put an authenticating proxy in front.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:DB-GPT affected <= 0.8.2 fixed no fixed version listed

## How to check

- Check the DB-GPT version: 0.8.2 (latest release, 26 Aug 2026) and earlier are listed as affected; the reporter tested 0.8.1 on the official Docker image.
- Check whether port 5670 is reachable from untrusted networks and whether api_keys is empty in your config (the default, per the reporter, means no authentication).
- Check for apps using the CodeEngineer agent (CodeAction), and for 'EXECUTING CODE BLOCK' lines or tmp_code_* scripts in the server logs.

## Timeline

- 2026-11-05T12:38:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123018
- 2026-11-05T12:41:23+00:00 analyst https://github.com/eosphoros-ai/DB-GPT/issues/3287 — No fix: latest release v0.8.2 (releases page), issue #3287 open with no maintainer response. Matching the CVE to #3287 is likely but not stated by NVD. Nothing verified: no maintainer/vendor statement exists, only the reporter's issue. Exploited-in-the-wild not shown; PoC steps are in the issue.

## Documents

- [describes] DB-GPT #3287: CodeAction executes LLM-generated code natively (unauthenticated RCE) https://github.com/eosphoros-ai/DB-GPT/issues/3287
- [mentions] DB-GPT releases (latest v0.8.2) https://github.com/eosphoros-ai/DB-GPT/releases

## From the sources

A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_