EUVD-2026-90416
GHSA-4q5p-v9jh-hg59
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed DB-GPT API
-
DeliveryUpload malicious skill via /skills/upload
-
ExploitInvoke /chat/react-agent to load skill
-
ExecutionInjected code executes on server
-
ImpactFull host compromise (C:H/I:H/A:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reachability of two specific DB-GPT REST endpoints: /api/v1/skills/upload (to plant a malicious skill) and /api/v1/chat/react-agent (to invoke the react-agent flow that executes the uploaded skill). The react-agent/skills feature must be in use for the execution path to be reachable. The CVSS vector states PR:N (no privileges) and UI:N (no user interaction), so no authentication or victim action is claimed; however, the practical limiting factor is network exposure of these API routes - instances that keep the DB-GPT API bound to localhost, behind authentication, or on an isolated network significantly reduce exploitability. Affected scope is limited to DB-GPT versions 0.7.5 and 0.8.0. |
| Impact | Signals are moderately consistent but point to a potent-yet-not-yet-widespread threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a remote, low-complexity, unauthenticated path to total compromise, and CWE-94 (code injection) plus the described upload-then-execute flow make RCE the realistic outcome. SSVC reinforces this: Technical Impact: total and Automatable: yes mean a successful exploit fully owns the host and can be scripted at scale. However, SSVC Exploitation is only 'poc' (not active), and EPSS is low at 0.20% (9th percentile), which is consistent with publicly available exploit code existing (a referenced gist) but no evidence of mass exploitation yet. No CISA KEV listing is present in the input. The main tension to flag: CVSS claims PR:N (unauthenticated), but the attack depends on reaching the /api/v1/skills/upload endpoint - if a deployment places these routes behind authentication or network isolation, real-world exploitability drops substantially; verify endpoint exposure/auth in the specific deployment. Net assessment: a genuine high-priority RCE for any internet-exposed or multi-tenant DB-GPT instance, but the low EPSS and poc-only status suggest it is not yet subject to broad opportunistic scanning. |
| Exploit ScenarioDerived | An attacker reaches an exposed DB-GPT instance and POSTs a malicious skill to the real /api/v1/skills/upload endpoint, embedding attacker-controlled code. They then invoke /api/v1/chat/react-agent to trigger the uploaded skill, causing the injected code to execute on the server and yielding remote code execution. Public exploit code exists (a referenced gist), lowering the effort required to reproduce this against versions 0.7.5 and 0.8.0. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated remote code execution is possible in DB-GPT 0.7.5 and 0.8.0 through the combination of two first-party REST endpoints: a crafted skill uploaded via /api/v1/skills/upload can subsequently be invoked and executed by the /api/v1/chat/react-agent flow, which loads and runs the stored skill without adequate validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated network-reachable attacker with no victim interaction can achieve full confidentiality, integrity, and availability impact, and the SSVC assessment rates technical impact as total with automatability confirmed; publicly available exploit code exists (SSVC Exploitation: poc) but there is no CISA KEV listing, so confirmed active exploitation in the wild is not established. Despite the severe base score, EPSS is only 0.20% (9th percentile), reflecting the practical requirement that both the skills-upload and react-agent features be reachable and exposed - instances bound to localhost, placed behind authentication, or on isolated networks are far less exposed.
RemediationAI
No vendor-released patch was identified in the provided intelligence at the time of analysis; the upstream reference is a GitHub issue (https://github.com/eosphoros-ai/DB-GPT/issues/3047) rather than a tagged fix release, so check that issue and the project's release notes for an updated version and treat any future release explicitly referencing CVE-2026-51866 as the upgrade target - do not assume 0.7.5 or 0.8.0 are fixed. Until a patch is confirmed, apply compensating controls specific to this two-endpoint chain: block or restrict external access to /api/v1/skills/upload and /api/v1/chat/react-agent at the reverse proxy or API gateway so untrusted clients cannot reach either route (this breaks the exploit chain at both the plant and trigger stages, at the cost of disabling legitimate skill installation and agent chat); bind the DB-GPT API to localhost or a management VLAN and require an authenticated reverse proxy in front of it, since the CVSS vector claims PR:N and the API's own authentication cannot be relied upon as a boundary (side effect: all remote API consumers must be re-routed or given credentials). If the skills/ReAct-agent capability is not needed in production, disable the skills feature and the react-agent chat flow entirely (side effect: loss of agentic functionality, but the largest reduction in attack surface). Additionally, run the DB-GPT service under a low-privilege OS account with a read-only container filesystem and egress restrictions to limit post-exploitation impact, and monitor for POST requests to /api/v1/skills/upload followed by calls to /api/v1/chat/react-agent from the same client as a detection heuristic. Because public exploit code exists, prioritize exposure reduction over detection alone for any internet-facing deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-94 (Improper Control of Generation of Code / Code Injection) is the root cause class here: DB-GPT's agent framework treats user-supplied 'skills' as executable logic rather than inert data. The product is an open-source LLM application framework (eosphoros-ai/DB-GPT) that exposes a REST API, including /api/v1/skills/upload for installing reusable agent skills and /api/v1/chat/react-agent for the ReAct-style agent execution loop. Because the uploaded skill is later loaded and evaluated by the agent runtime without sufficient sandboxing or provenance validation, an attacker who can reach the upload route effectively gains an arbitrary-code-execution primitive through the chat path - a classic stored second-order code injection where the injection point (upload) and the trigger point (react-agent invocation) are distinct endpoints. The CPE data supplied is a placeholder (cpe:2.3:a:n/a:n/a:*:*), so exact platform CPE identification is unavailable; scoping is therefore based on the version information in the advisory, which limits affected scope to DB-GPT 0.7.5 and 0.8.0. The vulnerability also reflects a broader risk pattern in agentic/LLM tooling, where tool and skill registries become remote code loading surfaces.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote low-complexity code injection via network-exposed upload and execution endpoints with no claimed authentication yields full RCE, so PR:N and C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.
Executive ViewAI
DB-GPT versions 0.7.5 and 0.8.0 ship with an unauthenticated remote code execution weakness that allows any attacker who can reach the network service to upload and then trigger execution of arbitrary code, fully compromising the host and everything it can access. This matters to leadership because affected instances may hold LLM API keys, proprietary model data, internal credentials, and integration access that extend well beyond the DB-GPT deployment itself, and no vendor fix is yet available. Exposure is highest for teams that run DB-GPT as a shared or internet-reachable service rather than an isolated developer tool.
No vendor-released patch identified at time of analysis. Interim mitigations: network-isolate or remove internet exposure for DB-GPT 0.7.5/0.8.0 instances; block or disable the /api/v1/skills/upload and /api/v1/chat/react-agent endpoints at the proxy/WAF; restrict API access to trusted IP ranges; require authentication at a fronting layer; monitor and alert on skill-upload and react-agent activity; and plan migration or a tested workaround until the vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB