by Kastro
Paper/Archive/CVE-2025-0868

CVE-2025-0868

Arc53 DocsGPT — Remote Code Execution in DocsGPT

EPSS 17%CVSS 9.3
critical.is priorityof 100
47
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 97.1.971 × 2019.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.. This issue affects DocsGPT: from 0.8.1 through 0.12.0.

Affected

ProductAffectedFixed inSource
DocsGPT0.8.1 – 0.12.0–CNA

Scores by source

CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcert.pl/en/posts/2025/02/CVE-2025-0868writeupcert.pl/posts/2025/02/CVE-2025-0868refgithub.com/arc53/DocsGPT