# CVE-2026-123018: eosphoros-ai DB-GPT code injection in CodeAction

Source: https://junglewise.ai/threats/cve-2026-123018-a-security-flaw-has-been-discovered-in-eosphoros-ai-db-gpt-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-123018 · Severity: high · CVSS 8.3 · Published 2026-11-05

DB-GPT is an AI data assistant that uses agents to interact with databases and execute code. A critical flaw allows unauthenticated attackers to inject and execute arbitrary Python and shell code directly on the server without sandboxing, due to a flawed Docker detection check that bypasses the product's own sandbox when running in containers. An attacker can remotely execute code with server privileges, read environment variables including LLM API keys, and access databases.

Technologies: [Eosphoros-Ai DB-GPT](https://junglewise.ai/threats/technologies/db-gpt). Vendors: [Eosphoros-Ai](https://junglewise.ai/threats/vendors/eosphoros-ai).

## Quick answers

**Is CVE-2026-123018 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123018 being exploited in the wild.

**How severe is CVE-2026-123018?** High severity, with a CVSS score of 8.3, published 5 November 2026.

**Which products and versions are affected?** Eosphoros-Ai DB-GPT up to 0.8.2.

**Is there a fix for CVE-2026-123018?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123018 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123018?** Check whether you run Eosphoros-Ai DB-GPT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The CodeAction component executes code blocks extracted from LLM output via the execute_code() function in code_utils.py. The vulnerability stems from an OR short-circuit in the Docker detection logic (line 257: `if not use_docker or in_docker_container`) that always evaluates to true inside Docker containers, causing code to execute natively via subprocess.run() instead of being sandboxed. Combined with zero authentication enabled by default and no execution gating in the review() function, this enables unauthenticated remote code execution through the chat and app creation APIs.

## Affected products

- eosphoros-ai DB-GPT up to 0.8.2

## Timeline

- 2026-10-14: disclosed: Issue #3287 opened on GitHub
- 2026-11-05: advisory: CVE-2026-123018 published

## References

- [https://github.com/eosphoros-ai/DB-GPT/](https://github.com/eosphoros-ai/DB-GPT/)
- [https://github.com/eosphoros-ai/DB-GPT/issues/3287](https://github.com/eosphoros-ai/DB-GPT/issues/3287)

## Related threats

- [eosphoros-ai DB-GPT remote code execution in HuggingFace adapter](https://junglewise.ai/threats/cve-2026-123019-a-weakness-has-been-identified-in-eosphoros-ai-db-gpt-up-to-0-8)
- [DB-GPT directory traversal in use_example_file](https://junglewise.ai/threats/cve-2026-51863-db-gpt-v0-7-5-and-0-8-0-contains-directory-traversal-in-use)
- [DB-GPT hardcoded credentials in default Docker configuration](https://junglewise.ai/threats/cve-2026-77933-db-gpt-through-0-8-2-contains-a-hardcoded-credentials)
- [DB-GPT unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-77932-db-gpt-through-0-8-2-contains-an-unauthenticated-remote-code)
- [DB-GPT sandbox API fallback to LocalRuntime code execution](https://junglewise.ai/threats/cve-2026-51869-db-gpt-v0-8-0-sandbox-api-silently-falls-back-to-localruntime-and)