PYSEC-2026-322

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/dbgpt/PYSEC-2026-322.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-322

Aliases

Published

2026-06-29T11:50:34.563661Z

Modified

2026-06-29T12:15:17.781173581Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

DB-GPT Arbitrary File Write vulnerability

Details

In eosphoros-ai/db-gpt version v0.6.3 and earlier, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as __init__.py in the Python's /site-packages/ directory.

References

Affected packages

PyPI / dbgpt

Package

Name: dbgpt; View open source insights on deps.dev
Purl: pkg:pypi/dbgpt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.6.3

Affected versions

0.*

0.4.7

0.5.0

0.5.1rc0

0.5.1

0.5.2rc0

0.5.2

0.5.3rc0

0.5.3

0.5.4rc0

0.5.4

0.5.5rc0

0.5.5

0.5.6rc0

0.5.6

0.5.7rc0

0.5.7

0.5.8

0.5.9rc0

0.5.9

0.5.10

0.6.1

0.6.2

0.6.3rc0

0.6.3rc1

0.6.3rc2

0.6.3rc3

0.6.3

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/dbgpt/PYSEC-2026-322.yaml"