MEDIUM 5.5 NVD
CVE-2026-123019
A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_adapter.py of the component HuggingFace A
A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_adapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trust_remote_code can lead to inclusion of functionality from untrusted control sphere. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
References
- https://github.com/eosphoros-ai/DB-GPT/
- https://github.com/eosphoros-ai/DB-GPT/issues/3290
- https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-hf-model-trust
- https://vuldb.com/cve/CVE-2026-123019
- https://vuldb.com/submit/1033097
This medium severity vulnerability with a CVSS score of 5.5 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.