Evidence · DiggingBeagle record
Advisory: DB-GPT unauthenticated model registration plus trust_remote_code allows model repository Python execution
The default DB-GPT Hugging Face adapter enabled trust_remote_code while a model registration endpoint allowed a caller to influence the selected repository. CVE-2026-123019 shows that Python in a chosen model repository can execute at module load, before the integrity of model weights is evaluated. Exploitation requires accessible registration and service privileges; no production incident was demonstrated. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
The default DB-GPT Hugging Face adapter enabled trust_remote_code while a model registration endpoint allowed a caller to influence the selected repository. CVE-2026-123019 shows that Python in a chosen model repository can execute at module load, before the integrity of model weights is evaluated. Exploitation requires accessible registration and service privileges; no production incident was demonstrated. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (2)
- supportsDB-GPT model registration could execute Python from attacker-selected model repositories: CVE-2026-123019 shows that Python in a chosen model repository can execute at module load, before the integrity of model weights is evaluated. Exploitation requires accessible registration and service privileges; no production incident was demonstrated.
GHSA-w66p-3ghr-2qhf; adapter trust_remote_code and registration path
- supportsDB-GPT model registration could execute Python from attacker-selected model repositories: The default DB-GPT Hugging Face adapter enabled trust_remote_code while a model registration endpoint allowed a caller to influence the selected repository.
GHSA-w66p-3ghr-2qhf; adapter trust_remote_code and registration path