Dbgpt version v0.6.0 contains a critical SQL Injection vulnerability in its web API endpoint POST /api/v1/editor/sql/run that allows unauthenticated users to execute arbitrary SQL queries. Exploitation can lead to Arbitrary File Write on the victim's file system via DuckDB SQL, potentially resulting in Remote Code Execution. This vulnerability is fixed in version 0.7.1.