Threats tagged 'ghsa-7gj6-22m4-qfhx'

Dbgpt versions 0.6.3 and earlier contain a vulnerability in the web API endpoint POST /api/v1/editor/chart/run that allows execution of arbitrary SQL queries without access control. This flaw enables attackers to perform arbitrary file writes on the victim's file system, potentially leading to remote code execution by placing malicious files such as __init__.py in Python's site-packages directory.