Which versions of DocsGPT are affected by CVE-2026-26015?

DocsGPT versions 0.15.0 through 0.16.0 contain a critical vulnerability enabling unauthenticated attackers to execute arbitrary commands on affected systems, including the hosted arc53 platform and…. A patch is available.

How to fix or mitigate CVE-2026-26015?

Within 24 hours, conduct a complete inventory of DocsGPT installations across your environment and identify which systems run versions 0.15.0 through 0.16.0. Within 7 days, apply the available vendor patch to all affected instances, prioritizing internet-facing deployments and those containing sensitive data. Within 30 days, complete a verification audit confirming all instances have been patched or upgraded beyond 0.16.0, and review server logs for suspicious command execution patterns that may indicate prior exploitation.

DocsGPT CVE-2026-26015

Q: What is the CVSS score of CVE-2026-26015?

CVE-2026-26015 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-26258 CRITICAL

Command Injection (CWE-77)

2026-04-29 GitHub_M

RCE Command Injection Docsgpt

10.0

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network-reachable MCP test path yields command execution (PR:N/UI:N/AC:L); RCE breaks out of the app to the host, so S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 01:37 vuln.today

Analysis Generated

Jul 24, 2026 - 01:37 vuln.today

Patch released

May 01, 2026 - 12:56 nvd

Patch available

Apr 29, 2026 - 19:02 EUVD

CVSS changed

Apr 29, 2026 - 18:22 NVD

10.0 (CRITICAL)

EUVD ID Assigned

Apr 29, 2026 - 18:00 euvd

EUVD-2026-26258

CVE Published

Apr 29, 2026 - 17:37 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.

AnalysisAI

Remote code execution in DocsGPT 0.15.0 through 0.16.0 (exclusive) lets an attacker reach the application's 'MCP test' function and submit a crafted payload that bypasses its validation to run arbitrary commands on the host. Because the hosted arc53 DocsGPT site and any local or public self-hosted deployment expose the same code path, exploitation requires no authentication or user interaction (CVSS 4.0 base 10.0, CWE-77 command injection). Publicly available exploit code exists per SSVC, though EPSS remains low at 0.29% and it is not listed in CISA KEV.

Technical ContextAI

DocsGPT is a Python/JavaScript retrieval-augmented documentation chatbot (CPE cpe:2.3:a:arc53:docsgpt) that added Model Context Protocol (MCP) support to let the assistant invoke external tool servers. The vulnerability lives in the 'MCP test' feature, which is intended to validate an MCP server/tool configuration before use. Rooted in CWE-77 (improper neutralization of special elements used in a command), the test routine passes attacker-influenced input into a command/tool execution path without adequate sanitization, so a payload constructed to bypass the intended test behavior is executed by the server. This fits the broader class of MCP supply-chain RCE issues documented by ox.security, where the trust boundary between an AI orchestrator and the tool/command layer is inadequately enforced.

RemediationAI

Upgrade to the fixed release immediately - Vendor-released patch: 0.16.0 (https://github.com/arc53/DocsGPT/releases/tag/0.16.0), which the vendor advisory GHSA-gcrq-f296-2j74 identifies as remediating this issue. Until you can upgrade, reduce exposure by taking the MCP integration/'MCP test' functionality out of reach: disable or do not configure MCP tool testing, and place the DocsGPT instance behind authentication and network restrictions so the endpoint is not reachable by untrusted users (trade-off: this blocks legitimate MCP tool setup and any anonymous/public chat use). Additionally restrict outbound execution privileges of the DocsGPT process/container and run it as a low-privilege, sandboxed user to limit blast radius if the path is triggered (trade-off: may break tools that legitimately need broader access). For the official hosted site, apply the vendor's server-side fix.