GitHub Advisoryadvisory · npm

GHSA-9gff-5v8w-x922 DocsGPT Allows Remote Code Execution

CRITICAL Published 2025-02-20 Modified 2025-02-20 Official page ↗
Aliases
CVE-2025-0868
Ecosystem
npm
Packages
docsgpt
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-77, CWE-95
Reviewed
2025-02-20

Affected packages

• npm docsgpt: >= 0.8.1, <= 0.12.0 (no fix yet)

Description

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint. This issue affects DocsGPT: from 0.8.1 through 0.12.0.

Related

Alias · CVE (1)

  • CVE-2025-0868 A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References