{"id":"CVE-2026-123019","kind":"vulnerability","aliases":["CVE-2026-123019"],"related":[],"title":"DB-GPT: HuggingFace adapter lets remote input load untrusted code","description":"A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_adapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trust_remote_code can lead to inclusion of functionality from untrusted control sphere. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"DB-GPT, an AI application framework, has a weakness in its HuggingFace adapter where manipulating the trust_remote_code argument can cause untrusted code to be loaded. A remote attacker could use a public exploit to run functionality from an untrusted source on the affected server.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DB-GPT","fixed":[],"affected":"<= 0.8.2","ecosystem":"pip"}],"ecosystems":[],"tags":["ai-apps","ai-tooling","db-gpt","huggingface","python","self-hosted"],"not_affected_if":["newer-version","no-huggingface-adapter"],"how_to_check":"Check whether DB-GPT is 0.8.2 or earlier (0.8.2 is the latest release, so every release is in range). Look in hf_adapter.py and your model config for models loaded with trust_remote_code enabled, and whether the DB-GPT API is reachable by untrusted users.","fix":"No fixed version known: the latest release is v0.8.2, and the NVD entry says the project has not responded to the report. Until a patch ships, do not enable trust_remote_code for models, only load models you trust, and keep the DB-GPT API off untrusted networks.","status":"open","published_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","triaged_at":"2026-11-05T12:40:10+00:00","updated_at":"2026-11-05T12:41:17+00:00","category":"ai-tooling","confidence":0.55,"triage":{"at":"2026-11-05T12:40:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DB-GPT: HuggingFace adapter lets remote input load untrusted code","impact":"high","summary":"DB-GPT, an AI application framework, has a weakness in its HuggingFace adapter where manipulating the trust_remote_code argument can cause untrusted code to be loaded. A remote attacker could use a public exploit to run functionality from an untrusted source on the affected server.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["db-gpt","python","huggingface","ai-apps"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"untrusted code runs on the DB-GPT server","analyst_note":"Check the NVD entry and the project's repository for a fixed version or a patch; the sources say no response from the vendor yet.","how_to_check":"- Check whether the DB-GPT version in use is `0.8.2` or earlier.\n- Look for use of the HuggingFace adapter (hf_adapter.py) and whether models are loaded with trust_remote_code enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["no-huggingface-adapter","newer-version"],"who_is_affected":"Teams running DB-GPT up to version 0.8.2 with its HuggingFace adapter in use, where model loading can be reached from outside the network. Deployments that do not use the HuggingFace adapter or that keep remote code loading disabled are less exposed. The sources say the project has not yet responded to the report.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000714,"input_tokens":4281,"output_tokens":572,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the project's repository for a fixed version or a patch; the sources say no response from the vendor yet.","search":"'-123019':14A,17A '-2026':13A,16A '0.8.2':96C 'adapt':5A,48B,111C 'affect':80B 'ai':22B,25B,39B,90C 'ai-app':21B 'ai-tool':24B 'app':23B 'applic':40B 'argument':55B,117C 'attack':65B,132C,151C 'avail':142C 'caus':57B 'code':11A,54B,59B,120C 'compon':109C 'control':129C 'could':66B,147C 'cve':12A,15A 'db':2A,19A,28B,36B,92C 'db-gpt':1A,18A,27B,35B,91C 'earli':159C 'eosphoro':89C 'eosphoros-ai':88C 'exec':101C 'execut':112C 'exploit':70B,138C 'file':105C 'framework':41B 'function':73B,100C,126C 'gpt':3A,20A,29B,37B,93C 'hf_adapter.py':106C 'host':34B 'huggingfac':4A,30B,47B,110C 'identifi':86C 'impact':97C 'inclus':124C 'inform':155C 'input':8A 'issu':162C 'launch':135C 'lead':122C 'let':6A 'load':9A,62B 'made':141C 'manipul':50B,114C 'modul':102C 'problem':158C 'project':153C 'public':69B,145C 'python':31B 'remot':7A,53B,64B,119C,136C 'report':163C 'respond':167C 'run':72B 'self':33B 'self-host':32B 'server':81B 'sourc':77B 'sphere':130C 'tool':26B 'trust':52B,118C 'untrust':10A,58B,76B,128C 'use':67B,149C 'weak':44B,83C 'yet':168C","nicknames":[],"mitigations":[],"who_affected":"Teams running DB-GPT up to version 0.8.2 with its HuggingFace adapter in use, where model loading can be reached from outside the network. Deployments that do not use the HuggingFace adapter or that keep remote code loading disabled are less exposed. The sources say the project has not yet responded to the report.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["dbgpt"],"ptokens":["db","gpt"],"labels":["aiapps","aitooling","dbgpt","high","huggingface","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123019","severity":null,"published_at":"2026-11-05T12:17:50+00:00","modified_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","fetched_at":"2026-11-05T12:38:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123019:1776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123019","severity":null,"published_at":"2026-11-05T12:41:17+00:00","modified_at":"2026-11-05T12:41:17+00:00","first_seen_at":"2026-11-05T12:41:17+00:00","fetched_at":"2026-11-05T12:41:17+00:00","note":"Only NVD/VulDB-derived text found; no maintainer advisory or issue for this CVE located. Latest DB-GPT release is v0.8.2 (26 Aug), the affected ceiling, so no fixed version exists in releases. Nothing verified; PoC link not found.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-123019","https://github.com/eosphoros-ai/DB-GPT/releases"]}],"documents":[{"id":76189,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123019","title":"NVD CVE-2026-123019","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1306,"url":"https://github.com/eosphoros-ai/DB-GPT/releases","title":"DB-GPT releases (latest v0.8.2)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}