CVE-2025-0868

Remote Code Execution in DocsGPT

CVSS 9.3 CRITICALEPSS 15.1%CWE-95

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.. This issue affects DocsGPT: from 0.8.1 through 0.12.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

Arc53 · DocsGPT

PoCs públicas encontradas — 2

githubgithub.com/aidana-gift/CVE-2025-0868★ 1 exploitdbwww.exploit-db.com/exploits/52145no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://cert.pl/en/posts/2025/02/CVE-2025-0868/https://cert.pl/posts/2025/02/CVE-2025-0868/https://github.com/arc53/DocsGPT