DB-GPT executed untrusted uploaded SKILL.md templates before model invocation

DB-GPT rendered uploaded SKILL.md instructions as unrestricted Jinja2 template code while building a model prompt. The malicious template could access Python objects in the application before the LLM received the text.

CVE-2026-123020 describes service-context execution via an upload/chat path with weak default authentication. DB-GPT 0.8.2 is identified as the fix; the advisory reports a controlled proof rather than a known breach.

The untrusted surface was an uploaded skill instruction file, but the execution boundary was a template engine rather than a language model. DB-GPT's FileBasedSkill.get_prompt used unrestricted Jinja2 processing to turn text into the prompt delivered to the assistant. Expressions in SKILL.md could therefore reach Python objects inside the service while the system assembled a prompt. The issue must not be described as the model choosing to obey a malicious instruction. The advisory identifies version 0.8.2 and patch a9e7a3c as the corrected implementation, though independent deployment verification is outside this research. Literal skill content and sandboxed, tightly scoped template variables would remove the pre-model execution mechanism.

The attacker-controlled material is ostensibly an instruction file, yet the dangerous interpreter is Jinja2, not the language model. Rendering that file as a template can execute Python objects before a model sees the prompt. Upload authorization and strict template evaluation therefore matter even if the eventual model would refuse a malicious instruction. The separate DB-GPT model-loading and CodeAction vulnerabilities have different triggers; shared application ownership does not make this one a model-generated shell attack.