cve-2025-0868

CRITICAL CVSS 9.3 opencve
Description

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.. This issue affects DocsGPT: from 0.8.1 through 0.12.0.

Timeline
Published
2025-02-20 12:15 UTC
Last Modified
2026-06-17
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-95 CWE-77
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N mitre
4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X nvd
4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N opencve
References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "advisories": [
    {
      "id": "GHSA-9gff-5v8w-x922",
      "source": "ghsa",
      "title": "DocsGPT Allows Remote Code Execution",
      "url": "https://github.com/advisories/GHSA-9gff-5v8w-x922"
    }
  ],
  "cve": "CVE-2025-0868",
  "enrichment": {
    "created": "2025-07-13T11:07:26.442008+00:00",
    "updated": "2025-07-13T11:07:26.442061+00:00",
    "vendors": [
      "arc53",
      "arc53$PRODUCT$docsgpt"
    ]
  },
  "epss": {
    "score": 0.17087
  },
  "mitre": {
    "cpes": [],
    "created": "2025-02-20T11:26:11.784000+00:00",
    "description": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {
        "score": 9.3,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
      }
    },
    "mitre_repo_path": "cves/2025/0xxx/CVE-2025-0868.json",
    "references": [
      "https://cert.pl/en/posts/2025/02/CVE-2025-0868/",
      "https://cert.pl/posts/2025/02/CVE-2025-0868/",
      "https://github.com/arc53/DocsGPT"
    ],
    "title": "Remote Code Execution in DocsGPT",
    "updated": "2025-10-03T08:56:10.028000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-95"
    ]
  },
  "nvd": {
    "cpes": [],
    "created": "2025-02-20T12:15:10.893000+00:00",
    "description": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {
        "score": 9.3,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    },
    "nvd_repo_path": "2025/CVE-2025-0868.json",
    "references": [
      "https://cert.pl/en/posts/2025/02/CVE-2025-0868/",
      "https://cert.pl/posts/2025/02/CVE-2025-0868/",
      "https://github.com/arc53/DocsGPT"
    ],
    "title": null,
    "updated": "2026-06-17T08:27:17.080000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-95"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2025-02-20T11:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Remote Code Execution in DocsGPT",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-77"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://cert.pl/en/posts/2025/02/CVE-2025-0868/",
                "https://cert.pl/posts/2025/02/CVE-2025-0868/",
                "https://github.com/arc53/DocsGPT"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV4_0": {
                  "score": 9.3,
                  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "8a83913e-9c84-472b-bb29-b5f15dff9e30"
      },
      {
        "created": "2025-02-20T15:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "none",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "616bd7c7-3c1c-4695-ad84-71d4be842d2d"
      },
      {
        "created": "2025-10-03T09:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0.",
              "old": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0."
            },
            "type": "description"
          },
          {
            "details": {
              "added": [
                "CWE-95"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "8aba3a6b-38cd-4d6a-92c9-c681e5b02e44"
      },
      {
        "created": "2025-10-03T09:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-77"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "4ebe05f7-3006-4bbe-a691-3f37e3bd9ea0"
      }
    ],
    "cpes": {
      "data": [],
      "providers": []
    },
    "created": {
      "data": "2025-02-20T11:26:11.784000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {},
        "provider": null
      },
      "cvssV4_0": {
        "data": {
          "score": 9.3,
          "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        },
        "provider": "mitre"
      },
      "epss": {
        "data": {
          "score": 0.17087
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "none",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://cert.pl/en/posts/2025/02/CVE-2025-0868/",
        "https://cert.pl/posts/2025/02/CVE-2025-0868/",
        "https://github.com/arc53/DocsGPT"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Remote Code Execution in DocsGPT",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-04-15T00:35:42.020000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "arc53",
        "arc53$PRODUCT$docsgpt"
      ],
      "providers": [
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-95"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2025-02-20T11:26:11.784000+00:00",
    "description": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "none",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Remote Code Execution in DocsGPT",
    "updated": "2025-02-20T14:15:18.315000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2025/0xxx/CVE-2025-0868.json",
    "weaknesses": []
  }
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
Nuclei templates
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON