| عنوان | eosphoros-ai DB-GPT 0.8.1 CWE-829 Inclusion of Functionality from Untrusted Control Sphere |
|---|
| الوصف | DB-GPT v0.8.1 (eosphoros-ai/DB-GPT) executes remote code shipped with any HuggingFace model by default: trust_remote_code defaults to True in both the parameter class HFLLMDeployModelParameters (packages/dbgpt-core/src/dbgpt/model/adapter/hf_adapter.py:46-48) and the adapter base class NewHFChatModelAdapter (hf_adapter.py:124), and loader.py:366-369 forwards trust_remote_code=True into from_pretrained, so transformers downloads the model repository and exec_module() executes arbitrary Python code from it (CWE-829, no sandbox, no model-source allowlist, no human confirmation). The model registration endpoint POST /api/v2/serve/model/models (endpoints.py:190) carries no authentication dependency, and the auth layer returns role="admin" for any or no user-id header (auth.py:25-38); with the default x.x.x.x:5670 binding (configs/dbgpt-proxy-deepseek.toml:9-10) an unauthenticated attacker registers a malicious provider="hf" model and triggers loading, and the malicious code executes inside the DB-GPT server process (dynamically verified 2026-08-08, PoC 6/6: marker file created, pid != PoC client pid, argv contains dbgpt). The attacker can read database configuration, source code, credentials and environment variables, write arbitrary files, and terminate processes (C/I/A:H). Publishing the malicious model to a public HuggingFace repository extends the attack to any deployment that loads it (phishing / supply-chain poisoning). The path is independent of Docker and present in the default configuration.
Affected: DB-GPT v0.8.1 (eosphoros-ai/DB-GPT). Patched versions: none (no official fix released as of the filing date 2026-08-19).
Reported to the vendor: https://github.com/eosphoros-ai/DB-GPT/issues/3290 (public issue filed 2026-10-14); otherwise reported via CNVD only (accepted as CNVD-2026-37343 on 2026-09-17); GHSA not used. |
|---|
| المصدر | ⚠️ https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-hf-model-trust-remote-code-default-remote-code-execution.md |
|---|
| المستخدم | Ybyu (UID 101038) |
|---|
| ارسال | 14/10/2026 10:23 AM (22 أيام منذ) |
|---|
| الاعتدال | 05/11/2026 07:18 AM (22 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 431393 [eosphoros-ai DB-GPT حتى 0.8.2 HuggingFace Adapter hf_adapter.py exec_module trust_remote_code تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|