Docsgpt
Monthly
Remote code execution in DocsGPT 0.15.0 through 0.16.0 (exclusive) lets an attacker reach the application's 'MCP test' function and submit a crafted payload that bypasses its validation to run arbitrary commands on the host. Because the hosted arc53 DocsGPT site and any local or public self-hosted deployment expose the same code path, exploitation requires no authentication or user interaction (CVSS 4.0 base 10.0, CWE-77 command injection). Publicly available exploit code exists per SSVC, though EPSS remains low at 0.29% and it is not listed in CISA KEV.
Credential storage in DocsGPT up to 0.18.0 uses AES-CBC - an unauthenticated cipher mode - allowing a low-privilege authenticated attacker to tamper with encrypted credential blobs without detection, as the application performs no integrity or authenticity verification before decrypting. The root cause (CWE-345) is the absence of authenticated encryption: CBC provides confidentiality only, with no MAC or HMAC binding, and the legacy implementation also lacked any user_id binding, enabling potential cross-user credential replay. Publicly available exploit code exists (CVSS 4.0 E:P), though no confirmed active exploitation (not in CISA KEV); the upstream fix in PR #2331 migrates to AES-GCM with user_id-bound AAD but has not yet been merged.
Remote code execution in DocsGPT 0.15.0 through 0.16.0 (exclusive) lets an attacker reach the application's 'MCP test' function and submit a crafted payload that bypasses its validation to run arbitrary commands on the host. Because the hosted arc53 DocsGPT site and any local or public self-hosted deployment expose the same code path, exploitation requires no authentication or user interaction (CVSS 4.0 base 10.0, CWE-77 command injection). Publicly available exploit code exists per SSVC, though EPSS remains low at 0.29% and it is not listed in CISA KEV.
Credential storage in DocsGPT up to 0.18.0 uses AES-CBC - an unauthenticated cipher mode - allowing a low-privilege authenticated attacker to tamper with encrypted credential blobs without detection, as the application performs no integrity or authenticity verification before decrypting. The root cause (CWE-345) is the absence of authenticated encryption: CBC provides confidentiality only, with no MAC or HMAC binding, and the legacy implementation also lacked any user_id binding, enabling potential cross-user credential replay. Publicly available exploit code exists (CVSS 4.0 E:P), though no confirmed active exploitation (not in CISA KEV); the upstream fix in PR #2331 migrates to AES-GCM with user_id-bound AAD but has not yet been merged.