Evidence · DiggingBeagle record
Advisory: DB-GPT uploaded SKILL.md executes Python while Jinja2 renders model prompt before LLM sees it
DB-GPT rendered uploaded SKILL.md instructions as unrestricted Jinja2 template code while building a model prompt. The malicious template could access Python objects in the application before the LLM received the text. CVE-2026-123020 describes service-context execution via an upload/chat path with weak default authentication. DB-GPT 0.8.2 is identified as the fix; the advisory reports a controlled proof rather than a known breach. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
DB-GPT rendered uploaded SKILL.md instructions as unrestricted Jinja2 template code while building a model prompt. The malicious template could access Python objects in the application before the LLM received the text. CVE-2026-123020 describes service-context execution via an upload/chat path with weak default authentication. DB-GPT 0.8.2 is identified as the fix; the advisory reports a controlled proof rather than a known breach. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (3)
- supportsDB-GPT executed untrusted uploaded SKILL.md templates before model invocation: CVE-2026-123020 describes service-context execution via an upload/chat path with weak default authentication. DB-GPT 0.8.2 is identified as the fix; the advisory reports a controlled proof rather than a known breach.
GHSA-x327-5gx8-j9v4; FileBasedSkill.get_prompt and Template.render
- supportsDB-GPT executed untrusted uploaded SKILL.md templates before model invocation: DB-GPT rendered uploaded SKILL.md instructions as unrestricted Jinja2 template code while building a model prompt. The malicious template could access Python objects in the application before the LLM received the text.
GHSA-x327-5gx8-j9v4; FileBasedSkill.get_prompt and Template.render
- supportsDB-GPT executed untrusted uploaded SKILL.md templates before model invocation: The DB-GPT skill-template advisory identifies version 0.8.2 as the correction for pre-model Jinja template execution; the demonstrated code path executes while constructing the prompt, not because the model follows the SKILL.md instructions.
GHSA-x327-5gx8-j9v4, FileBasedSkill.get_prompt, patched release