CyberRota Analysis
AI-GeneratedDB-GPT versions 0.7.5 and 0.8.0 are vulnerable due to a flaw that allows skills uploaded via the /api/v1/skills/upload endpoint to be executed through the /api/v1/chat/react-agent flow, potentially leading to unauthorized actions or data exposure. Organizations using these versions should prioritize remediation to mitigate the risk of exploitation, especially if they handle sensitive information or rely on skill-based functionalities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.