lol. lmao.
https://nvd.nist.gov/vuln/detail/cve-2026-77932
> DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.
:rainbowCrow:
npub1s6…8n008
2026-10-20 13:31:07 UTC
Author Public Key
npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008Published at
2026-10-20 13:31:07 UTCEvent JSON
{
"id": "21cc680890d3da24ed58db50d0d799054baac6147eea339a7c7bd495cee34e5b",
"pubkey": "86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac",
"created_at": 1792503067,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@cR0w/117473481009075386",
"web"
],
[
"proxy",
"https://infosec.exchange/users/cR0w/statuses/117473481009075386",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/cR0w/statuses/117473481009075386",
"pink.momostr"
],
[
"-"
]
],
"content": "lol. lmao.\n\nhttps://nvd.nist.gov/vuln/detail/cve-2026-77932\n\n\u003e DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.",
"sig": "f27d05932c75c0aaa2831f906a46ab8943e6dfbfad05b745602e49f505f7c6e1c3f584dd7aeead957802a4809775ec6a9fcad5aa29408653e0615b991bdb0b07"
}