eosphoros-ai DB-GPT

• CVE-2026-123020 Medium 6.3 eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine 0.5%
• CVE-2026-123019 High 7.3 eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere 0.4%
• CVE-2026-123018 High 8.3 eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection 0.5%
• CVE-2026-77933 Critical 9.8 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment 0.4%
• CVE-2026-77932 Critical 9.8 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent 0.8%
• CVE-2026-80104 Critical 9.8 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename 1.1%
• CVE-2026-73034 Critical 9.8 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header 5.7%
• CVE-2026-4505 Medium 6.3 eosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload 0.2%
• CVE-2026-4504 High 7.3 eosphoros-ai db-gpt Incomplete Fix editor sql injection 0.3%
• CVE-2026-3409 High 7.3 eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection 0.4%
• CVE-2025-6772 High 7.3 eosphoros-ai db-gpt import import_flow path traversal 0.6%