CVE-2025-0868: DocsGPT Allows Remote Code Execution
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint. This issue affects DocsGPT: from 0.8.1 through 0.12.0.
Published Feb 20, 2025 · Updated Oct 3, 2025
Affected packages
docsgpt
- Ecosystem
- npm
- Affected
- >= 0.8.1, <= 0.12.0
- Fixed in
- No patched version yet
- Check
npm ls docsgpt
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.
This issue affects DocsGPT: from 0.8.1 through 0.12.0.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology