dbgpt-app npm Package Vulnerability: Critical Risk Alert
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- dbgpt-app (npm)
- Affected versions
- >= v0.8.0, <= v0.8.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the dbgpt-app npm package. This vulnerability could allow a remote attacker to execute arbitrary code.
What happened
The dbgpt-app npm package, specifically version 0.8.0, is under investigation for a critical vulnerability. This issue arises from the way the destination path for an uploaded skill is constructed without proper constraints. An attacker could exploit this to write attacker-controlled bytes to any path the server process can write, potentially leading to code execution.
This vulnerability has been assigned the identifier CVE-2026-80104 and carries a CVSS score of 9.8, indicating a critical severity level. The vulnerability has not been reported as exploited in the wild at this time.
What to do about it
- Await a patch from the maintainers of dbgpt-app.
- Monitor for any updates or advisories from the maintainers.
- Review your project dependencies for the affected version of dbgpt-app.
- Consider temporarily removing or replacing dbgpt-app in your project until a patch is available.
- Stay informed by consulting the primary sources for updates on this vulnerability.
How 0Day would have caught this
dbgpt-app is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if your project includes dbgpt-app version 0.8.0.
What should I do right now?
Monitor for updates from the maintainers and consider removing or replacing the affected version of dbgpt-app in your project.
Is there a patch available?
No official fix has been published yet. Monitor the sources for updates.
How severe is this vulnerability?
The vulnerability is rated as critical with a CVSS score of 9.8.