01 Record

CVE-2026-123018

eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection

MediumPUBLISHEDCNA: VulDB

CNA base score6.9 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

View raw JSON

02 Description

eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Not recorded
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-11-05 11:45Z1 HR AGO

Last updated

2026-11-05 11:45Z1 HR AGO

Reserved

2026-11-05

Assigning CNA

VulDB

Record state

PUBLISHED

Severity

Medium (CVSS 6.9)

CNA CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

Weaknesses

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentClass
CWE-94Improper Control of Generation of CodeBase

Data version

5.2

Document digest

933f2a8c4c5bb873bc47201f86040b552b6c5d7c7ecb73ce921c2606a60c6f06

05 Affected products

VendorProductVersionsPlatforms

eosphoros-aiDB-GPT0.8.0, 0.8.1, 0.8.2—

06 References

vuldb.comVDB-431392 | eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injectionhttps://vuldb.com/vuln/431392vdb-entrytechnical-description
vuldb.comVDB-431392 | CTI Indicators (IOB, IOC, TTP, IOA)https://vuldb.com/vuln/431392/ctisignaturepermissions-required
vuldb.comCVE-2026-123018 | CVE Analysis and Reporthttps://vuldb.com/cve/CVE-2026-123018third-party-advisory
vuldb.comSubmit #1033094 | eosphoros-ai DB-GPT 0.8.1 CWE-94 Improper Control of Generation of Code ('Code Injection')https://vuldb.com/submit/1033094third-party-advisory
github.comhttps://github.com/eosphoros-ai/DB-GPT/issues/3287issue-tracking
github.comhttps://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-codeaction-native-subprocess-llm-code-execution.mdexploit
github.comhttps://github.com/eosphoros-ai/DB-GPT/product