{"action":"Upgrade dbgpt to 0.7.1 or later.","affected":[{"fixed":"0.7.1","introduced":"0"}],"component":"dbgpt","cve_ids":["CVE-2024-10835"],"ecosystem":"PyPI","epss":0.01183,"exploited":false,"fixed_versions":["0.7.1"],"ghsa_id":"GHSA-qccg-9m4q-xfm6","id":"tcs_01M5KH48XQ1SHMAGK666J7K6GB","modified_at":"2026-07-01T20:22:50.988562Z","published_at":"2026-06-29T11:50:35.006576Z","references":["https://osv.dev/vulnerability/PYSEC-2026-325","https://nvd.nist.gov/vuln/detail/CVE-2024-10835","https://github.com/eosphoros-ai/DB-GPT/pull/2650","https://github.com/eosphoros-ai/DB-GPT","https://github.com/eosphoros-ai/DB-GPT/releases/tag/v0.7.1","https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9","https://pypi.org/project/dbgpt","https://github.com/advisories/GHSA-qccg-9m4q-xfm6"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-325","url":"https://osv.dev/vulnerability/PYSEC-2026-325"}],"summary":"DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users"}