Critical severity9.8NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026
CVE-2024-10901
CVE-2024-10901
Description
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as __init__.py in the Python's /site-packages/ directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dbgptPyPI | <= 0.6.3 | — |
Affected products
3- cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*
- eosphoros-ai/eosphoros-ai/db-gptv5Range: unspecified
Patches
Vulnerability mechanics
References
5- huntr.com/bounties/db2c1d59-6e3a-4553-a1f6-94c8df162a18nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-7gj6-22m4-qfhxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-10901ghsaADVISORY
- github.com/eosphoros-ai/DB-GPT/commit/295cdb8723663d5b0954d5d1dfb4f02b7223b8ffghsaWEB
- github.com/eosphoros-ai/DB-GPT/pull/2269ghsaWEB
News mentions
0No linked articles in our index yet.