Open-source package vulnerability · PyPI

CVE-2024-10835: DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users

criticalCVSS 3.0 9.1GHSA-qccg-9m4q-xfm6

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).

Published Mar 20, 2025 · Updated Jul 17, 2025

Affected packages

dbgpt

Ecosystem: PyPI
Affected: < 0.7.1
Fixed in: 0.7.1
Check: pip show dbgpt

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries