| शीर्षक | eosphoros-ai DB-GPT <=0.7.5 Remote command execution |
|---|
| विवरण | There is fix of Arbitray SQL Run in web api `/api/v1/editor/chart/run` and `/api/v1/editor/sql/run` for CVE-2024-10835 & CVE-2024-10901 to filter the user input sql. However, the sql in llm's output which can be easily controlled by user prompt is considered trusted and execute directly. So malicious user can guide the llm to run arbitrary sql, which may cause Remote Code Execution, Arbitray File Read/Write by specific sql of different database type. |
|---|
| स्रोत | ⚠️ https://github.com/Ka7arotto/cve/blob/main/dbgpt-duckdb-rce/issue.md |
|---|
| उपयोगकर्ता | Goku (UID 80486) |
|---|
| सबमिशन | 06/03/2026 12:20 PM (7 महीनों पहले) |
|---|
| संयम | 20/03/2026 03:03 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 352070 [eosphoros-ai db-gpt तक 0.7.5 Incomplete Fix /api/v1/editor/ SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|