Unauthenticated remote code execution in DocsGPT MCP STDIO configuration (CVE-2026-26015)

DocsGPT's MCP connection test endpoint fails to restrict the `transport_type` parameter, allowing an unauthenticated attacker to supply `transport_type=stdio` alongside a crafted command payload. The server passes the `server_url` validity check then executes the attacker-controlled command via `StdioTransport`, resulting in arbitrary remote code execution on any local or public DocsGPT deployment. Affected versions: - >= 0.15.0, < 0.16.0 We recommend updating to: 0.16.0. CVSS 10.0 · our assessment: act_now Reference: https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74 Details: https://vuln.today/cve/CVE-2026-26015