GHSA-9gff-5v8w-x922

DocsGPT Allows Remote Code Execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-0868

Packages

Ecosystem	Package	Affected	Fixed in
npm	docsgpt	>= 0.8.1, <= 0.12.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint. This issue affects DocsGPT: from 0.8.1 through 0.12.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-0868 advisory
https://cert.pl/en/posts/2025/02/CVE-2025-0868 web
https://cert.pl/posts/2025/02/CVE-2025-0868 web
https://github.com/arc53/DocsGPT web
https://github.com/arc53/docsgpt package