CVE-2025-0868
Remote Code Execution in DocsGPT
- State
- Published
- Severity
- 9.3 Critical
- Published
- Feb 20, 2025
- Updated
- Oct 3, 2025
- Reserved
- Jan 30, 2025
Description
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..
This issue affects DocsGPT: from 0.8.1 through 0.12.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected Products
| Product | Versions |
|---|---|
DocsGPTArc53 |
|
References
- https://cert.pl/en/posts/2025/02/CVE-2025-0868/third-party-advisory
- https://cert.pl/posts/2025/02/CVE-2025-0868/third-party-advisory
- https://github.com/arc53/DocsGPTproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.