CVE-2026-123018

DB-GPT executes generated code inside its service container

eosphoros-ai · DB-GPT CodeEngineer CodeAction

First documented disclosure · Review checkpoint

Summary

A prompted code block can execute with the DB-GPT service account’s permissions.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher demonstrated a marker write in an official Docker setup. Production exploitation is unestablished.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

CodeAction sends generated code to a native subprocess when the server detects it is already in a container. A separate execution sandbox is then skipped.

Conditions required

An attacker can reach the code-generating agent and induce executable output. The researcher used the default deployment with no API key and created the agent through the API.

Potential impact

Code can read process-accessible secrets or modify mounted data. A marker write demonstrated execution inside the service environment.

Affected versions and configurations

VulDB lists versions through 0.8.2. The researcher tested 0.8.1, and the 0.8.2 tagged runner retains the container shortcut.

Fix and mitigation status

No verified fixed release.

Practical next steps

Restrict API access and disable native execution of generated code. Run permitted workloads in a separate low-privilege sandbox.

Operating lesson

Test isolation from inside the actual service container, including the path used when a sandbox dependency is unavailable.

Evidence and limits

The public report is dated October 14. August testing is an experiment date. The demonstrated result was execution inside the service container, without evidence of escape to the host.

Sources