Vulnerability · Published Mar 2, 2026 · Assigned by VulDB

CVE-2026-3409eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection

High 7.3

In plain English

A high-severity code injection in db-gpt from eosphoros-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 68.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/awel/flow/import of the component Flow Import Endpoint. Performing a manipulation as part of File results in code injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
eosphoros-ai	db-gpt	0.7.5

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-348304 | eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection vdb-entry, technical-description, exploit
VDB-348304 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #763745 | eosphoros-ai DB-GPT 0.7.5 Code Injection (CWE-94) third-party-advisory
https://gist.github.com/YLChen-007/d2799d8b2077e50658f12a45bcae9b70 broken-link, exploit