CVE-2026-26015

DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/arc53/DocsGPT/releases/tag/0.16.0	Release Notes
https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74	Exploit Vendor Advisory
https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/
https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/
https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arc53:docsgpt:0.15.0:*:*:*:*:*:*:*

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) DocsGPT es un chat impulsado por GPT para documentación. Desde la versión 0.15.0 hasta antes de la versión 0.16.0, un atacante que acceda tanto al sitio web oficial de DocsGPT como a cualquier despliegue local y público, puede crear una carga útil maliciosa eludiendo el comportamiento de la ’prueba MCP’ para lograr la ejecución remota de código (RCE) arbitraria. Este problema ha sido parcheado en la versión 0.16.0.

Information

Published : 2026-04-29 18:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-26015

Mitre link : CVE-2026-26015

CVE.ORG link : CVE-2026-26015

JSON object : View

Products Affected

arc53

docsgpt

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-26015", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26015", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-30T13:03:22.221448Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "arc53", "product": "DocsGPT", "versions": [{"status": "affected", "version": ">= 0.15.0, < 0.16.0"}]}]}], "published": "2026-04-29T18:16:03.817", "references": [{"url": "https://github.com/arc53/DocsGPT/releases/tag/0.16.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the \"MCP test\" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0."}, {"lang": "es", "value": "DocsGPT es un chat impulsado por GPT para documentaci\u00f3n. Desde la versi\u00f3n 0.15.0 hasta antes de la versi\u00f3n 0.16.0, un atacante que acceda tanto al sitio web oficial de DocsGPT como a cualquier despliegue local y p\u00fablico, puede crear una carga \u00fatil maliciosa eludiendo el comportamiento de la \u2019prueba MCP\u2019 para lograr la ejecuci\u00f3n remota de c\u00f3digo (RCE) arbitraria. Este problema ha sido parcheado en la versi\u00f3n 0.16.0."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arc53:docsgpt:0.15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02A5F20D-8AA8-4080-BACC-E2719F8A3521"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}