critical9.3Public exploit code
CVE-2025-0868
DocsGPT Allows Remote Code Execution
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DocsGPT 0.12.0 - Remote Code Execution2025-04-09 · webapps · python · Verified
Impact
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint. This issue affects DocsGPT: from 0.8.1 through 0.12.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | docsgpt | >= 0.8.1, <= 0.12.0 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| DocsGPT: From 0.8.1 | through 0.12.0. |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://cert.pl/en/posts/2025/02/CVE-2025-0868/
- https://cert.pl/posts/2025/02/CVE-2025-0868/
- https://github.com/arc53/DocsGPT
- https://github.com/advisories/GHSA-9gff-5v8w-x922
- https://nvd.nist.gov/vuln/detail/CVE-2025-0868
- https://cert.pl/en/posts/2025/02/CVE-2025-0868
- https://cert.pl/posts/2025/02/CVE-2025-0868