01 Record

CVE-2026-123019

eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere

MediumPUBLISHEDCNA: VulDB

CNA base score6.9 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

View raw JSON

02 Description

eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Not recorded
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-11-05 12:00Z1 HR AGO

Last updated

2026-11-05 12:00Z1 HR AGO

Reserved

2026-11-05

Assigning CNA

VulDB

Record state

PUBLISHED

Severity

Medium (CVSS 6.9)

CNA CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Weaknesses

CWE-829Inclusion of Functionality from Untrusted Control SphereBase

Data version

5.2

Document digest

6ea3e03d66f532477360c82e8392627f89f357b05ee4048a4797eedba91797a6

05 Affected products

VendorProductVersionsPlatforms

eosphoros-aiDB-GPT0.8.0, 0.8.1, 0.8.2—

06 References

vuldb.comVDB-431393 | eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control spherehttps://vuldb.com/vuln/431393vdb-entrytechnical-description
vuldb.comVDB-431393 | CTI Indicators (IOB, IOC, IOA)https://vuldb.com/vuln/431393/ctisignaturepermissions-required
vuldb.comCVE-2026-123019 | CVE Analysis and Reporthttps://vuldb.com/cve/CVE-2026-123019third-party-advisory
vuldb.comSubmit #1033097 | eosphoros-ai DB-GPT 0.8.1 CWE-829 Inclusion of Functionality from Untrusted Control Spherehttps://vuldb.com/submit/1033097third-party-advisory
github.comhttps://github.com/eosphoros-ai/DB-GPT/issues/3290issue-tracking
github.comhttps://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-hf-model-trust-remote-code-default-remote-code-execution.mdexploit
github.comhttps://github.com/eosphoros-ai/DB-GPT/product