CVE-2026-26015

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada arc53 docsgpt. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.

Rincian

Terbit di NVD

29 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74 exploit · advisory vendor
• https://github.com/arc53/DocsGPT/releases/tag/0.16.0 release notes
• https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/
• https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of...