Summary
A critical code-injection vulnerability in DB-GPT allows a skill uploaded through the production skill-upload route to be executed later through the React-agent chat flow. The risk arises when an attacker can submit or influence an uploaded skill and cause an agent workflow to invoke it.
Affected context
The issue affects DB-GPT deployments where:
- The real
/api/v1/skills/uploadendpoint accepts skill uploads - Uploaded skills remain available to the application or agent runtime
- The
/api/v1/chat/react-agentflow can later execute or invoke those skills - Upload authorization and skill trust boundaries do not sufficiently restrict untrusted content
Exploitability depends on deployment configuration, access controls, and whether uploaded skills are exposed to an executable agent workflow.
Exploit preconditions
- Attack surface: The production skill-upload API and the React-agent execution flow
- Required access: Permission or other ability to submit a skill through the upload route, depending on deployment controls
- Trigger point: A later chat request or agent workflow that invokes the uploaded skill
- Why exploitation is possible: Uploaded content is treated as executable agent functionality rather than strictly constrained, validated data
Why this happens
The underlying flaw is a failure to maintain a strong trust boundary between user-controlled uploaded skills and executable agent behavior.
When application logic permits uploaded content to become executable without sufficiently restricting its structure, capabilities, and origin, crafted content may influence server-side code execution.
This maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), where externally influenced input reaches a code-generation or execution path.
Potential impact
- An attacker may execute arbitrary code in the DB-GPT service context
- The application process could be compromised
- Sensitive prompts, credentials, files, or connected data sources could be exposed
- An attacker could modify application behavior or stored skills
- The service could be used for lateral movement or further compromise
General mitigation guidance
Mitigation generally focuses on preventing untrusted uploads from becoming executable behavior.
Common defensive patterns include:
- Restricting skill uploads to trusted, authenticated, and authorized sources
- Treating uploaded skills as data unless they have passed controlled review and validation
- Enforcing strict schemas, allowlists, and capability restrictions for skill content
- Isolating skill execution in sandboxed, short-lived environments with minimal privileges
- Separating upload, approval, storage, and execution permissions
- Limiting access from agent runtimes to credentials, host resources, and sensitive data
- Applying size, type, provenance, and lifecycle controls to uploaded artifacts
How teams detect issues like this
Organizations can look for:
- Static analysis rules that identify dynamic execution of uploaded or user-controlled content
- Code-review signals connecting upload handlers to agent dispatch or execution routines
- Authorization reviews covering both skill creation and later skill invocation
- Runtime telemetry correlating skill uploads with subsequent React-agent executions
- Policy checks requiring validation, approval, sandboxing, and least privilege before execution
- Automated application security testing that exercises upload-to-execution data flows without relying on fixed payloads
