What happened
Multiple code-execution defects in DB-GPT's agent layer: the CodeAction execute_code handler permits code injection (remotely reachable, public PoC), the HuggingFace adapter's exec_module trusts remote code when trust_remote_code is set, and the Jinja2 template handler for FileBasedSkill allows server-side template injection.
Why it matters
DB-GPT is an agentic database/LLM platform that executes code and loads models on the server. These paths let an attacker inject and run code or unsafe model code within the deployment, compromising the host and any database/LLM credentials the agent holds.
Attack vector
Remote attacker reaches the CodeAction execute_code path to inject code (public PoC), or loads a model/remote code via the HuggingFace adapter with trust_remote_code enabled, or triggers server-side template injection through a Jinja2 skill template. The project has not yet responded/published a fix; the PoC is public.
Affected systems
DB-GPT <= 0.8.2 (and <= 0.8.1 for the Jinja2 skill template issue)
Mitigation
No upstream fix published yet as of the report — monitor the DB-GPT repo for a patch; restrict exposure of the agent/CodeAction endpoints and do not enable trust_remote_code on untrusted models, and don't feed attacker-controlled Jinja2 skill templates. Track the GitHub issue #3287.