{"schema_version":1,"title":"Eosphoros-Ai DB-GPT vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 11 vulnerabilities in Eosphoros-Ai DB-GPT: 0 in the last 7 days and 10 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123019, was published on 5 November 2026. 5 vulnerabilities in the last four weeks, up 25% on the four before (4). 2 critical against 0.","url":"https://junglewise.ai/threats/technologies/db-gpt","json_url":"https://junglewise.ai/threats/technologies/db-gpt.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/db-gpt","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":2,"all_time":11,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":5,"last_90_days":10,"last_365_days":11},"latest":[{"cve":"CVE-2026-123019","cvss":7.3,"slug":"cve-2026-123019-a-weakness-has-been-identified-in-eosphoros-ai-db-gpt-up-to-0-8","title":"eosphoros-ai DB-GPT remote code execution in HuggingFace adapter","severity":"high","exploited":false,"published_at":"2026-11-05T12:17:50.193+00:00","url":"https://junglewise.ai/threats/cve-2026-123019-a-weakness-has-been-identified-in-eosphoros-ai-db-gpt-up-to-0-8"},{"cve":"CVE-2026-123018","cvss":8.3,"slug":"cve-2026-123018-a-security-flaw-has-been-discovered-in-eosphoros-ai-db-gpt-up-to","title":"eosphoros-ai DB-GPT code injection in CodeAction","severity":"high","exploited":false,"published_at":"2026-11-05T12:17:49.94+00:00","url":"https://junglewise.ai/threats/cve-2026-123018-a-security-flaw-has-been-discovered-in-eosphoros-ai-db-gpt-up-to"},{"cve":"CVE-2026-51863","slug":"cve-2026-51863-db-gpt-v0-7-5-and-0-8-0-contains-directory-traversal-in-use","title":"DB-GPT directory traversal in use_example_file","severity":"info","exploited":false,"published_at":"2026-10-29T18:17:32.293+00:00","url":"https://junglewise.ai/threats/cve-2026-51863-db-gpt-v0-7-5-and-0-8-0-contains-directory-traversal-in-use"},{"cve":"CVE-2026-77933","cvss":9.8,"slug":"cve-2026-77933-db-gpt-through-0-8-2-contains-a-hardcoded-credentials","title":"DB-GPT hardcoded credentials in default Docker configuration","severity":"critical","exploited":false,"published_at":"2026-10-20T01:17:19.67+00:00","url":"https://junglewise.ai/threats/cve-2026-77933-db-gpt-through-0-8-2-contains-a-hardcoded-credentials"},{"cve":"CVE-2026-77932","cvss":9.8,"slug":"cve-2026-77932-db-gpt-through-0-8-2-contains-an-unauthenticated-remote-code","title":"DB-GPT unauthenticated remote code execution","severity":"critical","exploited":false,"published_at":"2026-10-20T01:17:19.503+00:00","url":"https://junglewise.ai/threats/cve-2026-77932-db-gpt-through-0-8-2-contains-an-unauthenticated-remote-code"},{"cve":"CVE-2026-51869","slug":"cve-2026-51869-db-gpt-v0-8-0-sandbox-api-silently-falls-back-to-localruntime-and","title":"DB-GPT sandbox API fallback to LocalRuntime code execution","severity":"info","exploited":false,"published_at":"2026-09-30T21:17:12.717+00:00","url":"https://junglewise.ai/threats/cve-2026-51869-db-gpt-v0-8-0-sandbox-api-silently-falls-back-to-localruntime-and"},{"cve":"CVE-2026-51866","slug":"cve-2026-51866-in-db-gpt-0-7-5-and-0-8-0-a-skill-uploaded-through-the-real-api","title":"DB-GPT code execution in skill manager","severity":"info","exploited":false,"published_at":"2026-09-30T21:17:12.483+00:00","url":"https://junglewise.ai/threats/cve-2026-51866-in-db-gpt-0-7-5-and-0-8-0-a-skill-uploaded-through-the-real-api"},{"cve":"CVE-2026-51864","slug":"cve-2026-51864-db-gpt-v0-7-5-and-v0-8-0-contains-directory-traversal-in-python","title":"DB-GPT directory traversal in python_file_upload","severity":"info","exploited":false,"published_at":"2026-09-30T21:17:12.37+00:00","url":"https://junglewise.ai/threats/cve-2026-51864-db-gpt-v0-7-5-and-v0-8-0-contains-directory-traversal-in-python"},{"cve":"CVE-2026-51862","slug":"cve-2026-51862-db-gpt-0-8-0-contains-directory-traversal-in-skill-upload","title":"DB-GPT directory traversal in skill_upload endpoint","severity":"info","exploited":false,"published_at":"2026-09-30T21:17:12.243+00:00","url":"https://junglewise.ai/threats/cve-2026-51862-db-gpt-0-8-0-contains-directory-traversal-in-skill-upload"},{"cve":"CVE-2026-80104","cvss":9.8,"epss":0.0111,"slug":"cve-2026-80104-db-gpt-path-traversal-in-skill-upload-endpoint","title":"DB-GPT path traversal in skill upload endpoint","severity":"critical","exploited":false,"published_at":"2026-08-25T21:18:24.163+00:00","url":"https://junglewise.ai/threats/cve-2026-80104-db-gpt-path-traversal-in-skill-upload-endpoint"},{"cve":"CVE-2024-10906","cvss":3.1,"epss":0.0024,"slug":"cve-2024-10906-db-gpt-cross-site-request-forgery-via-permissive-cors","title":"PYSEC-2026-1289 - DB-GPT vulnerable to Cross-Site Request Forgery","severity":"low","exploited":false,"published_at":"2026-07-07T14:34:52.110006+00:00","url":"https://junglewise.ai/threats/cve-2024-10906-db-gpt-cross-site-request-forgery-via-permissive-cors"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":2,"exploited":0,"vulnerabilities":2},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Eosphoros-Ai DB-GPT","slug":"db-gpt","vendor":{"hub":true,"name":"Eosphoros-Ai","slug":"eosphoros-ai","url":"https://junglewise.ai/threats/vendors/eosphoros-ai"},"aliases":[],"category":"web-server","description":"An open-source framework for building data-centric AI applications with a focus on database interaction.","url":"https://junglewise.ai/threats/technologies/db-gpt"},"most_severe":[{"cve":"CVE-2026-80104","cvss":9.8,"epss":0.0111,"slug":"cve-2026-80104-db-gpt-path-traversal-in-skill-upload-endpoint","title":"DB-GPT path traversal in skill upload endpoint","severity":"critical","exploited":false,"published_at":"2026-08-25T21:18:24.163+00:00","url":"https://junglewise.ai/threats/cve-2026-80104-db-gpt-path-traversal-in-skill-upload-endpoint"},{"cve":"CVE-2026-77933","cvss":9.8,"slug":"cve-2026-77933-db-gpt-through-0-8-2-contains-a-hardcoded-credentials","title":"DB-GPT hardcoded credentials in default Docker configuration","severity":"critical","exploited":false,"published_at":"2026-10-20T01:17:19.67+00:00","url":"https://junglewise.ai/threats/cve-2026-77933-db-gpt-through-0-8-2-contains-a-hardcoded-credentials"},{"cve":"CVE-2026-77932","cvss":9.8,"slug":"cve-2026-77932-db-gpt-through-0-8-2-contains-an-unauthenticated-remote-code","title":"DB-GPT unauthenticated remote code execution","severity":"critical","exploited":false,"published_at":"2026-10-20T01:17:19.503+00:00","url":"https://junglewise.ai/threats/cve-2026-77932-db-gpt-through-0-8-2-contains-an-unauthenticated-remote-code"},{"cve":"CVE-2026-123018","cvss":8.3,"slug":"cve-2026-123018-a-security-flaw-has-been-discovered-in-eosphoros-ai-db-gpt-up-to","title":"eosphoros-ai DB-GPT code injection in CodeAction","severity":"high","exploited":false,"published_at":"2026-11-05T12:17:49.94+00:00","url":"https://junglewise.ai/threats/cve-2026-123018-a-security-flaw-has-been-discovered-in-eosphoros-ai-db-gpt-up-to"},{"cve":"CVE-2026-123019","cvss":7.3,"slug":"cve-2026-123019-a-weakness-has-been-identified-in-eosphoros-ai-db-gpt-up-to-0-8","title":"eosphoros-ai DB-GPT remote code execution in HuggingFace adapter","severity":"high","exploited":false,"published_at":"2026-11-05T12:17:50.193+00:00","url":"https://junglewise.ai/threats/cve-2026-123019-a-weakness-has-been-identified-in-eosphoros-ai-db-gpt-up-to-0-8"},{"cve":"CVE-2024-10906","cvss":3.1,"epss":0.0024,"slug":"cve-2024-10906-db-gpt-cross-site-request-forgery-via-permissive-cors","title":"PYSEC-2026-1289 - DB-GPT vulnerable to Cross-Site Request Forgery","severity":"low","exploited":false,"published_at":"2026-07-07T14:34:52.110006+00:00","url":"https://junglewise.ai/threats/cve-2024-10906-db-gpt-cross-site-request-forgery-via-permissive-cors"},{"cve":"CVE-2026-51863","slug":"cve-2026-51863-db-gpt-v0-7-5-and-0-8-0-contains-directory-traversal-in-use","title":"DB-GPT directory traversal in use_example_file","severity":"info","exploited":false,"published_at":"2026-10-29T18:17:32.293+00:00","url":"https://junglewise.ai/threats/cve-2026-51863-db-gpt-v0-7-5-and-0-8-0-contains-directory-traversal-in-use"},{"cve":"CVE-2026-51869","slug":"cve-2026-51869-db-gpt-v0-8-0-sandbox-api-silently-falls-back-to-localruntime-and","title":"DB-GPT sandbox API fallback to LocalRuntime code execution","severity":"info","exploited":false,"published_at":"2026-09-30T21:17:12.717+00:00","url":"https://junglewise.ai/threats/cve-2026-51869-db-gpt-v0-8-0-sandbox-api-silently-falls-back-to-localruntime-and"},{"cve":"CVE-2026-51866","slug":"cve-2026-51866-in-db-gpt-0-7-5-and-0-8-0-a-skill-uploaded-through-the-real-api","title":"DB-GPT code execution in skill manager","severity":"info","exploited":false,"published_at":"2026-09-30T21:17:12.483+00:00","url":"https://junglewise.ai/threats/cve-2026-51866-in-db-gpt-0-7-5-and-0-8-0-a-skill-uploaded-through-the-real-api"},{"cve":"CVE-2026-51864","slug":"cve-2026-51864-db-gpt-v0-7-5-and-v0-8-0-contains-directory-traversal-in-python","title":"DB-GPT directory traversal in python_file_upload","severity":"info","exploited":false,"published_at":"2026-09-30T21:17:12.37+00:00","url":"https://junglewise.ai/threats/cve-2026-51864-db-gpt-v0-7-5-and-v0-8-0-contains-directory-traversal-in-python"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}