DB-GPT model registration could execute Python from attacker-selected model repositories

The default DB-GPT Hugging Face adapter enabled trust_remote_code while a model registration endpoint allowed a caller to influence the selected repository.

CVE-2026-123019 shows that Python in a chosen model repository can execute at module load, before the integrity of model weights is evaluated. Exploitation requires accessible registration and service privileges; no production incident was demonstrated.

Unlike prompt injection, this path can run code before the model produces an answer. The adapter sets trust_remote_code for Hugging Face repositories, and a registration route can cause the service to load an attacker-selected repository. Python module import effects may execute during model initialization even when the weights are subsequently rejected. Registration authentication and repository admission are distinct controls: either can limit which artifact reaches the code-loading step, but disabling automatic remote code removes the dangerous default. The advisory lists DB-GPT through 0.8.2 and no confirmed fixed version; that is a disclosure-state observation, not proof that every deployment exposes registration publicly.

This execution happens while a model repository is being loaded, before any ordinary chat answer or tool plan. Enabling trust_remote_code gives repository-supplied Python the service's execution context; unprotected model registration lets an untrusted client choose what is loaded. The companion DB-GPT skill-template issue invokes Python through Jinja2 and its CodeAction issue runs generated actions without the expected isolation. All three cross different trust boundaries and need independent controls rather than a single generic prompt-injection filter.