CVE-2026-123020

A DB-GPT skill can supply an executable prompt template

eosphoros-ai · DB-GPT skill and agent prompt rendering

First documented disclosure · Review checkpoint

Summary

Uploaded instructions can enter a Jinja template and execute code before an agent contacts the model.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher reports controlled execution through an uploaded skill. Malicious exploitation was not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The vulnerable system-prompt renderer interpreted the skill text as executable template syntax in an unrestricted Jinja environment.

Conditions required

The attacker can supply a skill and invoke the affected agent. The researcher used the default API configuration without credentials.

Potential impact

A template can execute Python with the agent server’s permissions.

Affected versions and configurations

VulDB lists versions through 0.8.1. The researcher demonstrated the skill route on 0.8.1.

Fix and mitigation status

VulDB identifies 0.8.2. Its tagged build_system_prompt and shared formatter use SandboxedEnvironment.

Practical next steps

Use a release containing the sandboxed renderer, restrict skill uploads and test the actual agent route with untrusted template syntax.

Operating lesson

Treat skill prose as data when constructing a prompt. Template evaluation happens before model safeguards can intervene.

Evidence and limits

The June 23 public issue demonstrated the skill-upload route and linked fix proposal. The October 14 report independently reproduced the path on 0.8.1. The tagged source corroborates a renderer change; this review did not execute a regression test.

Sources