CVE-2026-123019 | eosphoros-ai DB-GPT up to 0.8.2 HuggingFace Adapter hf_adapter.py exec_module trust_remote_code inclusion of functionality from untrusted control sphere (Issue 3290)

SecurityVulns
Yanac

A vulnerability labeled as critical has been found in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_adapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trust_remote_code can lead to inclusion of functionality from untrusted control sphere.

This vulnerability is tracked as CVE-2026-123019. The attack can be launched remotely. Moreover, an exploit is present.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More