CVE-2024-10901 is a critical flaw (CVSS 9.8) in eosphoros-ai DB-GPT v0.6.0. The web API POST /api/v1/editor/chart/run runs arbitrary SQL with no access control, allowing arbitrary file writes and potentially remote code execution. No fix is confirmed, so keep DB-GPT off untrusted networks.
What's affected
The CVE record lists eosphoros-ai/db-gpt version v0.6.0. The description says the chart run API allows execution of arbitrary SQL queries without any access control and can be used for arbitrary file write. It names writing a file such as init.py into the Python site-packages directory as a route to remote code execution. The reference is a huntr report that I could not read.
I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release. This is one of three DB-GPT v0.6.0 records. The others are CVE-2024-10835 for the SQL run API and CVE-2024-10902 for the agent upload API.
How to check if you're exposed
Check the DB-GPT version in your deployment, such as the container tag or the project files, and compare it with v0.6.0.
Reachability is the useful question for this one. The vulnerable endpoint is part of the web server, so a deployment whose port is only open to a small trusted group is in a different position from one published on the internet. Map which networks can reach the service, and whether any gateway adds authentication.
If you track many findings, reachability analysis helps separate deployments where the vulnerable API is actually reachable from those where it is not. It does not replace the fix, but it tells you which environment to deal with first.
What to do now
- Find DB-GPT deployments and their versions.
- Put an authenticating proxy or VPN in front of the service, so the API is not open to anonymous callers.
- Run the service as an unprivileged user, and make Python package directories read only for it.
- Check the project for a release newer than v0.6.0 and read its notes.
- Look for unexpected files, such as new Python files in package directories, and treat any as an incident.
Why it matters
The class in the record is unrestricted upload of a dangerous file type (CWE-434), which here describes writing attacker chosen content to a chosen place. The cause the description gives is simpler: an API that runs arbitrary SQL without checking who is asking. A SQL engine with file writing features turns that into a file write.
Where a file lands matters. A Python file placed in a package directory can be run the next time the application imports it, which is how a write becomes code execution. Limiting file system rights and removing anonymous access removes the chain. This CVE is not on the CISA Known Exploited Vulnerabilities list, and nothing fetched reports attacks in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How is this different from CVE-2024-10835?
It is the same product and version, but a different endpoint. This one is the chart run API, and the other is the SQL run API.
Can file system permissions help?
Yes. If the service account cannot write to package or application directories, a file write reaches much less.
Sources
Last reviewed: 19 October 2026.
