CVE-2025-0868

Published Feb 20, 2025

Last updated 3 months ago

DocsGPT

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-0868 is a vulnerability found in DocsGPT versions 0.8.1 through 0.12.0. It stems from improper parsing of JSON data using the `eval()` function. This improper parsing allows an unauthorized attacker to send arbitrary Python code to be executed via the `/api/remote` endpoint, potentially leading to remote code execution (RCE).

Description: A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint. This issue affects DocsGPT: from 0.8.1 through 0.12.0.
Source: cvd@cert.pl
NVD status: Received

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

Weaknesses

cvd@cert.pl: CWE-77

Hype score: Not currently trending

References