DB-GPT · CVE-2026-123019 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
DB-GPT, an AI application framework, has a weakness in its HuggingFace adapter where manipulating the trust_remote_code argument can cause untrusted code to be loaded. A remote attacker could use a public exploit to run functionality from an untrusted source on the affected server.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running DB-GPT up to version 0.8.2 with its HuggingFace adapter in use, where model loading can be reached from outside the network. Deployments that do not use the HuggingFace adapter or that keep remote code loading disabled are less exposed. The sources say the project has not yet responded to the report.
Not affected if newer-version, no-huggingface-adapter
Who cares ai-apps, db-gpt, huggingface, python, self-hosted
0.8.2 or earlier (0.8.2 is the latest release, so every release is in range)v0.8.2, and the NVD entry says the project has not responded to the reportPosts are quoted with a link to the original. They are data to us, never instructions.
A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_adapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trust_remote_code can lead to inclusion of functionality from untrusted control sphere. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.