DB-GPT: Remote code execution via uploaded agent skills
Summary
DB-GPT versions 0.7.5 and 0.8.0 allow a skill uploaded through the skill upload API to be executed later through the ReAct agent chat flow. According to the public issue report, the uploaded script is wrapped into Python and started on the host, so an attacker who can use the upload and chat endpoints can run code with the privileges of the DB-GPT process. The CVE record rates the impact as total (CVSS 9.8). Whether authentication is required on these endpoints is not confirmed in the sources.
Affected
- DB-GPT 0.7.5
- DB-GPT 0.8.0
- Component: SkillManager.execute_skill_script_file (agent skill module)
Fixed in
Unknown. No fixed version is confirmed for this CVE in the sources. DB-GPT 0.8.1 fixes the related CVE-2026-80104, but whether it closes this path is unverified.
Workaround
- Restrict access to the skill upload and react-agent endpoints to trusted networks or block them at a reverse proxy or WAF.
- Place the service behind authentication.
- Review uploaded skills and unexpected Python files on the server.
Exploitation
- Public proof of concept: none confirmed for this CVE.
- Known exploited (CISA KEV): not listed, according to the sources.
- CISA SSVC: exploitation poc, automatable yes, technical impact total.
Our recommendation
- Inventory all DB-GPT instances and check for versions 0.7.5 and 0.8.0, including container images and PyPI installations.
- Immediately block or restrict the skill upload and react-agent routes, especially if the service is reachable from the internet or untrusted networks.
- Review the skills directory and server logs for unexpected scripts or executions.
- Monitor the vendor advisory and release notes and upgrade only after confirming that the fix covers this path.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub gist: CVE-2026-51866 reproduction notes gist.github.com
- GitHub issue #3047: Uploaded skill script executed via react-agent github.com
- MITRE/CVE text (VulDB mirror) vuldb.com
- Vulners VulnRichment record vulners.com
- INCIBE-CERT early warning www.incibe.es
- Strix CVE summary www.strix.ai
- ionix.io CVE-2026-80104 (related, fixed in 0.8.1) www.ionix.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:42.
Original description (NVD)
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.