CVE-2026-123018 eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123018?
CVE-2026-123018 is a medium-severity vulnerability in eosphoros-ai DB-GPT, published on 5 Nov 2026.
Official description
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Which versions are affected by CVE-2026-123018?
How do I fix CVE-2026-123018?
No fix has been published for CVE-2026-123018 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123018 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123018 exists.
Sources
Also known as GHSA-5h42-cm7h-7vh6.