EUVD-2026-90416

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

CVE-2026-51866

In DB-GPT versions 0.7.5 and 0.8.0 , a vulnerability exists where a skill uploaded via the /api/v1/skills/upload route can be subsequently executed through the /api/v1/chat/react-agent flow. No specific remediation or exploit code is provided in the documents, but a sighting is documented at http...