CVE-2026-123020Medium· 6.3▾ TwilightPoC availableA security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.get_prompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claude_skill/__init__.py of the component…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.get_prompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claude_skill/init.py of the component Jinja2 Template Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is sufficient to fix this issue. The identifier of the patch is a9e7a3c026d114fcfb4ffe3eaf78851a636ded16. It is suggested to upgrade the affected component.
DB-GPT 0.8.0DB-GPT 0.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123018High· 8.3eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection
CVE-2026-123019High· 7.3eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere
CVE-2026-77933Critical· 9.8DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
CVE-2026-77932Critical· 9.8DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
CVE-2026-108570Medium· 6.3A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95
CVE-2026-103540Medium· 6.3A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1