CVE-2025-0868CWE-95

Remote Code Execution in DocsGPT

Critical · published February 20, 2025

CVSS v4.0

9.3

EPSS

17%

Percentile

97.1

In the wild

Unconfirmed

What it is

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..

This issue affects DocsGPT: from 0.8.1 through 0.12.0.

The record

Technical detail

CVSS v4.0: 9.3 · CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.17087 · 97.1th percentile
Weakness: CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published: 2025-02-20T11:26Z

EPSS history

Timeline

20 FEB 11:26Z
Remote Code Execution in DocsGPT
cvelistv5