Vulnerabilities

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2.

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_adapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trust_remote_code can lead to inclusion of functionality from untrusted control sphere. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Eosphoros-Ai

Product

DB-GPT

CVSS v3.1

7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness

CWE-829

Exposure class

AI infrastructure

NVD status

Deferred

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-123019 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 23
   CVE NVD 12h ago

   A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1.

   CVSS 6.3 CVE-2026-123020 Eosphoros-Ai
2. 37
   CVE NVD 13h ago

   A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2.

   PoC public CVSS 8.3 CVE-2026-123018 Eosphoros-Ai