CVE-2026-31020
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In DocsGPT 0.15.0 and below, the custom prompt feature allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE).
Risk Assessment
An unauthenticated attacker could gain full control of the server, potentially leading to data theft, application modification, or use of the server for further attacks.
Recommendation
Upgrade DocsGPT to a version newer than 0.15.0 or apply appropriate mitigations such as input sanitization and sandboxing for Jinja templates.
Other vulnerabilities in DocsGPT
See all- CVE-2026-26015Critical
DocsGPT, a GPT-powered chat for documentation, has a vulnerability in versions from 0.15.0 to before 0.16.0 that allows an attacker to achieve remote code execution (RCE) via a malicious payload bypassing the 'MCP test'. This issue has been patched in version 0.16.0.
- CVE-2026-91201Medium
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to disconnect victims' cloud storage connectors.
- CVE-2026-13483Low
A vulnerability has been found in arc53 DocsGPT up to version 0.18.0 in the encrypt_credentials function within application/security/encryption.py. It involves insufficient verification of data authenticity, potentially allowing remote attacks. Although the exploit is difficult, it has been published and may be used.
Original NVD description (English source)
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS