GHSA-qccg-9m4q-xfm6

Suggest an improvement
Source
https://github.com/advisories/GHSA-qccg-9m4q-xfm6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-qccg-9m4q-xfm6/GHSA-qccg-9m4q-xfm6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qccg-9m4q-xfm6
Aliases
Published
2025-03-20T12:32:40Z
Modified
2026-06-29T12:26:30.571056863Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users
Details

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed_at": "2025-07-17T21:03:45Z",
    "github_reviewed": true,
    "nvd_published_at": "2025-03-20T10:15:20Z",
    "severity": "CRITICAL"
}
References

Affected packages

PyPI / dbgpt

Package

Name
dbgpt
View open source insights on deps.dev
Purl
pkg:pypi/dbgpt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.1

Affected versions

0.*
0.4.7
0.5.0
0.5.1rc0
0.5.1
0.5.2rc0
0.5.2
0.5.3rc0
0.5.3
0.5.4rc0
0.5.4
0.5.5rc0
0.5.5
0.5.6rc0
0.5.6
0.5.7rc0
0.5.7
0.5.8
0.5.9rc0
0.5.9
0.5.10
0.6.1
0.6.2
0.6.3rc0
0.6.3rc1
0.6.3rc2
0.6.3rc3
0.6.3
0.7.0rc0
0.7.0rc1
0.7.0
0.7.1rc0
0.7.1rc1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-qccg-9m4q-xfm6/GHSA-qccg-9m4q-xfm6.json"