CVE-2026-3409

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3409", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-01T09:39:44.943Z", "datePublished": "2026-03-02T04:02:08.022Z", "dateUpdated": "2026-03-02T15:05:26.398Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-02T04:02:08.022Z"}, "title": "eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "eosphoros-ai", "product": "db-gpt", "versions": [{"version": "0.7.5", "status": "affected"}], "modules": ["Flow Import Endpoint"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/awel/flow/import of the component Flow Import Endpoint. Performing a manipulation as part of File results in code injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-20T00:00:00.000Z", "lang": "en", "value": "Vulnerability found"}, {"time": "2026-03-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-01T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-01T14:27:52.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-x (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "Eric-x (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.348304", "name": "VDB-348304 | eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection", "tags": ["vdb-entry", "technical-description", "exploit"]}, {"url": "https://vuldb.com/?ctiid.348304", "name": "VDB-348304 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.763745", "name": "Submit #763745 | eosphoros-ai DB-GPT 0.7.5 Code Injection (CWE-94)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/d2799d8b2077e50658f12a45bcae9b70", "tags": ["broken-link", "exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T15:04:04.319567Z", "id": "CVE-2026-3409", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T15:05:26.398Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3409", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T15:04:04.319567Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T15:04:57.338Z"}}], "cna": {"title": "eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-x (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "Eric-x (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "eosphoros-ai", "modules": ["Flow Import Endpoint"], "product": "db-gpt", "versions": [{"status": "affected", "version": "0.7.5"}]}], "timeline": [{"lang": "en", "time": "2026-02-20T00:00:00.000Z", "value": "Vulnerability found"}, {"lang": "en", "time": "2026-03-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-01T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-01T14:27:52.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.348304", "name": "VDB-348304 | eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection", "tags": ["vdb-entry", "technical-description", "exploit"]}, {"url": "https://vuldb.com/?ctiid.348304", "name": "VDB-348304 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.763745", "name": "Submit #763745 | eosphoros-ai DB-GPT 0.7.5 Code Injection (CWE-94)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/d2799d8b2077e50658f12a45bcae9b70", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/awel/flow/import of the component Flow Import Endpoint. Performing a manipulation as part of File results in code injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-02T04:02:08.022Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3409", "state": "PUBLISHED", "dateUpdated": "2026-03-02T15:05:26.398Z", "dateReserved": "2026-03-01T09:39:44.943Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-02T04:02:08.022Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Flow Import Endpoint"], "product": "db-gpt", "vendor": "eosphoros-ai", "versions": [{"status": "affected", "version": "0.7.5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/awel/flow/import of the component Flow Import Endpoint. Performing a manipulation as part of File results in code injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha descubierto una falla de seguridad en eosphoros-ai db-gpt 0.7.5, la cual afecta a la funci\u00f3n importlib.machinery.SourceFileLoader.exec_module del archivo /API/v1/serve/awel/flow/import del componente Flow Import Endpoint. Al manipular como parte de Archivo se provoca una inyecci\u00f3n de c\u00f3digo. El ataque puede ser iniciado en remoto. El exploit ha sido publicado al p\u00fablico y puede ser usado para ataques. Antes de divulgar esta vulnerabilidad se contact\u00f3 con el proveedor, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-3409", "lastModified": "2026-06-17T10:43:33.517", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3409", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T15:04:04.319567Z", "version": "2.0.3"}}]}, "published": "2026-03-02T05:16:17.450", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/YLChen-007/d2799d8b2077e50658f12a45bcae9b70"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.348304"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.348304"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.763745"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "db-gpt", "source": "cna", "vendor": "eosphoros-ai"}, "product": "db-gpt", "vendor": "eosphoros-ai"}], "analysis": {"en": {"generated_at": "2026-04-17T13:36:43.726252+00:00", "value": {"mitigation_remediation": ["Apply any vendor\u2011provided patch for eosphoros\u2011ai db\u2011gpt 0.7.5 as soon as it is released.", "Until a patch is deployed, block or remove the Flow Import endpoint from the public API, or limit access to authenticated, trusted users only.", "Use network\u2011level controls such as IP whitelisting or firewall rules to restrict who can reach the vulnerable endpoint.", "Monitor application logs for abnormal file import activity and alert on unexpected execution patterns."], "summary": {"action": "Apply Patch", "impact": "Code Injection"}, "threat_synthesis": {"affected_systems": "Only eosphoros\u2011ai db\u2011gpt version 0.7.5 is affected. No additional vendors or product variants are listed.", "description_and_impact": "The Flow Import Endpoint in eosphoros\u2011ai db\u2011gpt version 0.7.5 processes files by calling importlib.machinery.SourceFileLoader.exec_module. The implementation fails to properly sanitize the file input, allowing an attacker to supply a malicious file that is executed during import. This flaw is a code injection vulnerability that can be triggered remotely through the exposed endpoint. The weakness is represented by CWE-74 (Improper Handling of Input) and CWE-94 (Improper Evaluation of Code without Adequate Restriction). An attacker who succeeds can run arbitrary code on the host, compromising confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS base score of 6.9 indicates moderate impact. The exploit is publicly released but the likelihood of real\u2011world exploitation remains very low at present; the risk of accidental or opportunistic attacks exists nevertheless. The vulnerability is not listed in the CISA KEV catalog. Attackers can invoke the flaw by sending a crafted file to the /api/v1/serve/awel/flow/import endpoint from a remote location."}}}}, "created": "2026-03-02T12:03:49.199025+00:00", "title": "Code Injection via Flow Import Endpoint in eosphoros\u2011ai db\u2011gpt 0.7.5", "updated": "2026-04-17T13:45:16.024811+00:00", "vendors": ["eosphoros-ai", "eosphoros-ai$PRODUCT$db-gpt"], "weaknesses": ["CWE-74", "CWE-94"]}