提出 #1033095: eosphoros-ai DB-GPT 0.8.1 CWE-94 Improper Control of Generation of Code ('Code Injection')

The ReAct chat agent of DB-GPT registers the code_interpreter tool by default as one of 12 tools in its ToolPack (agentic_data_api.py:3495-3512, code_interpreter at :3503). The tool takes arbitrary Python code, performs only a compile() syntax check (agentic_data_api.py:2018-2019), writes the code to a temporary script, and executes it natively on the host with asyncio.create_subprocess_exec(sys.executable, tmp_path) (agentic_data_api.py:2050-2061) — no sandbox, no command allowlist, no human confirmation, and independent of the Docker SDK. Because the default authentication is a mock that returns role="admin" for any or no user-id header (auth.py:25-38), an unauthenticated attacker can POST to /api/v1/chat/react-agent (agentic_data_api.py:4373-4377) and steer the LLM with a legitimate-sounding natural-language task to invoke code_interpreter, achieving unauthenticated remote code execution on the server host (reading sensitive files, writing backdoors, lateral movement). Verified against v0.8.1 (PoC 4/4 on 2026-08-07, marker file POC_EXECUTED).

Affected: DB-GPT 0.8.1 (eosphoros-ai/DB-GPT). Patched versions: none (not fixed as of the CNVD submission date).

Reported to the vendor: https://github.com/eosphoros-ai/DB-GPT/issues/3288 (public issue filed 2026-10-14); otherwise reported via CNVD only (accepted as CNVD-2026-37342 on 2026-09-17, severity high); GHSA not used.

• ソース: ⚠️ https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-codeinterpreter-native-subprocess-code-execution.md
• ユーザー: Ybyu (UID 101038)
• 送信: 2026年10月14日 10:20 (22 日 ago)
• モデレーション: 2026年11月05日 07:14 (22 days later)
• ステータス: 重複
• VulDBエントリ: 422583 [eosphoros-ai DB-GPT 迄 0.8.2 ReAct Agent /api/v1/chat/react-agent get_user_from_headers 特権昇格]
• ポイント: 0