CVE-2025-0868: Remote Code Execution in DocsGPT
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.
This issue affects DocsGPT: from 0.8.1 through 0.12.0.
Other sources
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..
This issue affects DocsGPT: from 0.8.1 through 0.12.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0868?
CVE-2025-0868 is considered to have a high severity due to its potential for Remote Code Execution.
How do I fix CVE-2025-0868?
To fix CVE-2025-0868, upgrade DocsGPT to version 0.12.0 or later to mitigate the vulnerability.
What causes CVE-2025-0868?
CVE-2025-0868 is caused by improper parsing of JSON data with eval(), allowing an attacker to execute arbitrary Python code.
What versions of DocsGPT are affected by CVE-2025-0868?
CVE-2025-0868 affects DocsGPT versions from 0.8.1 to 0.12.0.
Can CVE-2025-0868 lead to data compromise?
Yes, due to the Remote Code Execution (RCE) capabilities, CVE-2025-0868 can potentially lead to data compromise.