A sandbox API in DB‑GPT v0.8.0 silently falls back to a LocalRuntime when a sandbox cannot be established. This flaw causes any code sent through the API to be executed directly on the host system. The vulnerability permits an attacker to run arbitrary code with the privileges of the DB‑GPT process, leading to full compromise of the host machine. The weakness manifests as a logic error that bypasses the intended sandbox isolation controls.

DB‑GPT version 0.8.0, a community‑maintained open‑source AI tool that exposes a sandbox API. No other vendor or product versions were identified in the current CVE data.

The vulnerability can be exploited by sending specially crafted payloads to the sandbox API, which may be reachable over a network or local interface; based on the description this reachability is inferred rather than explicitly stated. Because the execution occurs without additional authentication or limits, the risk is high. The CVSS score is 9.8, and the EPSS score is less than 1%, indicating a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog, meaning no confirmed exploitation yet, but the ease of triggering the fallback and the full host execution capability suggest a severe threat that warrants prompt mitigation.