DB-GPT CodeAction code injection flaw

Summary

A code injection flaw was found in the execute_code function of code_utils.py in DB-GPT's CodeAction component. It can be attacked remotely and affects versions up to 0.8.2.

What to do

No fixed version is named. Affected versions go up to 0.8.2, so check that your DB-GPT is newer than 0.8.2 and read the vendor's advisory. The vendor has not yet responded.

Products and platforms

• DB-GPT

CVE IDs

• CVE-2026-123018 (opens in a new tab)

Sources

• Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)

Times

First published 2026-11-05 11:45 UTC

First seen 2026-11-09 16:40 UTC