Vulnerability · Published Feb 20, 2025 · Assigned by CERT-PL

CVE-2025-0868Remote Code Execution in DocsGPT

Critical 9.3

In plain English

A critical-severity security flaw in DocsGPT from Arc53. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 17.1% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)17.1%top 2.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.. This issue affects DocsGPT: from 0.8.1 through 0.12.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	docsgpt	no fix listed	GHSA-9gff-5v8w-x922

Affected products (as reported)

Vendor	Product	Versions
Arc53	DocsGPT	0.8.1 – through 0.12.0

Weakness: CWE-95 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2025/02/CVE-2025-0868/ third-party-advisory
https://cert.pl/posts/2025/02/CVE-2025-0868/ third-party-advisory
https://github.com/arc53/DocsGPT product