Evidence · DiggingBeagle record
Advisory: DB-GPT CodeAction runs model-generated Python/shell in main application container instead of disposable sandbox
The DB-GPT CodeAction runner used the presence of a Docker container as a condition to execute generated Python or shell in the current application process environment instead of a disposable sandbox. CVE-2026-123018 reports LLM-generated code reaching service-container subprocesses with a permissive approval path. Container execution does not itself establish compromise of the physical host. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
The DB-GPT CodeAction runner used the presence of a Docker container as a condition to execute generated Python or shell in the current application process environment instead of a disposable sandbox. CVE-2026-123018 reports LLM-generated code reaching service-container subprocesses with a permissive approval path. Container execution does not itself establish compromise of the physical host. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (2)
- supportsDB-GPT CodeAction executed model-generated code in its own application container: CVE-2026-123018 reports LLM-generated code reaching service-container subprocesses with a permissive approval path. Container execution does not itself establish compromise of the physical host.
GHSA-5h42-cm7h-7vh6; in_docker_container branch; CodeEngineer
- supportsDB-GPT CodeAction executed model-generated code in its own application container: The DB-GPT CodeAction runner used the presence of a Docker container as a condition to execute generated Python or shell in the current application process environment instead of a disposable sandbox.
GHSA-5h42-cm7h-7vh6; in_docker_container branch; CodeEngineer