CVE-2026-51866

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

EUVD-2026-90416

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

CVE-2026-51866: Improper Control of Generation of Code

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

CVE-2026-51866

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

PT-2026-103615

Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 through 0.8.0 Description A code injection issue exists where a skill uploaded via the '/api/v1/skills/upload' endpoint can subsequently be executed through the '/api/v1/chat/react-agent' flow. Recommendations At the...

CVE-2026-51866

Versions 0.7.5 through 0.8.0 of DB-GPT are vulnerable to a code injection issue (CWE-94). An attacker can upload a malicious skill via the /api/v1/skills/upload endpoint, which can subsequently be executed during the /api/v1/chat/react-agent flow. The impact includes potential compromise of confi...