CVE-2026-3409 | eosphoros-ai db-gpt 0.7.5 Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection

A vulnerability marked as critical has been reported in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/awel/flow/import of the component Flow Import Endpoint. Performing a manipulation results in code injection.

This vulnerability was named CVE-2026-3409. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.