eosphoros-ai/DB-GPT

eosphoros-ai/DB-GPT

Releases53

Frequency2 weeks 6 days

Last Release 2 months ago

Stars18.9K

open-source agentic AI data assistant for the next generation of AI + Data products.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-51458 ↗	Jul 22, 2025Tuesday, 22 July 2025, 20:15	6.5 MEDIUM	—
SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sql/run or /v1/editor/chart/run endpoints, interacting with api_editor_v1.editor_sql_run, editor_chart_run, and datasource.rdbms.base.query_ex.
CVE-2025-51459 ↗	Jul 22, 2025Tuesday, 22 July 2025, 19:15	6.5 MEDIUM	—
File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with plugin_hub._sanitize_filename and plugins_util.scan_plugins.
CVE-2025-6772 ↗	Jun 27, 2025Friday, 27 June 2025, 19:15	7.3 HIGH	7.5 HIGH
A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.