Open-source package vulnerability · PyPI

CVE-2024-10901: DB-GPT Arbitrary File Write vulnerability

criticalCVSS 3.0 9.1GHSA-7gj6-22m4-qfhx

In eosphoros-ai/db-gpt version v0.6.3 and earlier, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system.

Published Mar 20, 2025 · Updated Mar 21, 2025

Affected packages

dbgpt

Ecosystem: PyPI
Affected: <= 0.6.3
Fixed in: No patched version yet
Check: pip show dbgpt

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In eosphoros-ai/db-gpt version v0.6.3 and earlier, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as __init__.py in the Python's /site-packages/ directory.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries