DB-GPT through 0.8.2 allows unauthenticated RCE via /api/v1/chat/react-agent because get_user_from_headers is mocked to grant all callers the admin role. Attackers can send prompts that trigger the ReAct agent’s unsandboxed code_interpreter and shell_interpreter tools to run arbitrary Python/Bash as root in the webserver container and access the bundled DB using default creds. Upgrade past 0.8.2 to mitigate.