[Bug] [Chat Data] execute_code allows model-generated # filename paths to write files outside the configured work_dir

Search before asking

• I had searched in the issues and found no similar issues.

Operating system information

Windows

Python version information

=3.11

DB-GPT version

latest release

Related scenes

• Chat Data
• Chat Excel
• Chat DB
• Chat Knowledge
• Model Management
• Dashboard
• Plugins

Installation Information

• Installation From Source

• Docker Installation

• Docker Compose Installation

• Cluster Installation

• AutoDL Image

• Other

Device information

Device: CPU

Models information

LLM: claude-haiku-4-5-20251001

What happened

The real DB-GPT agent execution path accepts a model-generated Python block whose # filename: header can escape the configured work_dir.

In the validated runtime flow, the service accepted a payload with:

filename: ../outside/dbgpt_execcheck_payload_8e7e8097.py

and created the file at:

D:~~\DB-GPT\packages\dbgpt-core\src\dbgpt\\util\outside\dbgpt_execcheck_payload_8e7e8097.py

This is outside the intended work_dir boundary.

The affected function is:

packages/dbgpt-core/src/dbgpt/util/code_utils.py execute_code

What you expected to happen

A model-generated filename should be constrained to the configured work_dir. A relative path such as ../outside/... should not be able to create files outside that boundary.

I believe this behavior is incorrect because:

1. execute_code builds a filesystem path from the provided filename.
2. The final path is not confined back into work_dir before writing.
3. The real service path preserved file creation outside the intended workspace boundary.

How to reproduce

Steps to reproduce the behavior:

1. Clone DB-GPT and checkout 0.8.0.
2. Start the real DB-GPT service with the app/create and chat/completions routes available.
3. Create an app through the real /api/v1/app/create path.
4. Send a real prompt through /api/v1/chat/completions using a real OpenAI-compatible Claude model.
5. Make the model return exactly one Python code block whose first line is:

   filename: ../outside/dbgpt_execcheck_payload_8e7e8097.py

6. Let the remaining Python code be harmless.
7. Observe that DB-GPT writes the file outside the configured work_dir.

Observed validated created file: D:~~\DB-GPT\packages\dbgpt-core\src\dbgpt\\util\outside\dbgpt_execcheck_payload_8e7e8097.py

Relevant code path:

• /api/v1/app/create
• /api/v1/chat/completions
• CodeAction.run
• execute_code

Additional context

Even without the marker file, the file creation outside work_dir was confirmed on the real service path and is the core boundary violation.

Affected file: packages/dbgpt-core/src/dbgpt/util/code_utils.p

Are you willing to submit PR?

• Yes I am willing to submit a PR!