Critical severity9.8NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026
CVE-2024-10835
CVE-2024-10835
Description
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dbgptPyPI | < 0.7.1 | 0.7.1 |
Affected products
3- cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*
- eosphoros-ai/eosphoros-ai/db-gptv5Range: unspecified
Patches
Vulnerability mechanics
References
5- huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-qccg-9m4q-xfm6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-10835ghsaADVISORY
- github.com/eosphoros-ai/DB-GPT/pull/2650ghsaWEB
- github.com/eosphoros-ai/DB-GPT/releases/tag/v0.7.1ghsaWEB
News mentions
0No linked articles in our index yet.