CVE-2025-0868: DocsGPT RCE Vulnerability

CVE-2025-0868 Overview

A critical Remote Code Execution (RCE) vulnerability has been discovered in DocsGPT, an open-source AI documentation assistant. The vulnerability exists due to improper parsing of JSON data using Python's eval() function, allowing unauthorized attackers to execute arbitrary Python code via the /api/remote endpoint. This represents a severe security flaw that could enable complete system compromise without any authentication requirements.

Critical Impact

Unauthenticated attackers can achieve full remote code execution by sending malicious Python payloads to the vulnerable /api/remote endpoint, potentially leading to complete system compromise, data theft, or lateral movement within the network.

Affected Products

• DocsGPT versions 0.8.1 through 0.12.0

Discovery Timeline

• 2025-02-20 - CVE-2025-0868 published to NVD
• 2025-10-03 - Last updated in NVD database

Technical Details for CVE-2025-0868

Vulnerability Analysis

This vulnerability falls under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), commonly known as "Eval Injection" or "Code Injection." The fundamental issue stems from the application's use of Python's dangerous eval() function to parse JSON data received from user input without proper sanitization or validation.

The /api/remote endpoint accepts JSON-formatted data from external sources. Instead of using safe JSON parsing methods like Python's built-in json.loads(), the application processes this data through eval(), which interprets the input as executable Python code. This design flaw enables attackers to craft malicious payloads that execute arbitrary Python commands on the server.

The vulnerability is particularly severe because it requires no authentication, operates over the network, and has low attack complexity. Successful exploitation grants attackers the ability to execute code with the same privileges as the DocsGPT application, potentially allowing them to read sensitive documents, modify data, install backdoors, or pivot to other systems.

Root Cause

The root cause is the use of Python's eval() function for parsing user-supplied JSON data. The eval() function executes any valid Python expression passed to it, making it inherently dangerous when processing untrusted input. Developers should never use eval() to parse JSON data, as Python provides the safe json.loads() function specifically designed for this purpose. The lack of input validation and sanitization before the eval() call compounds the vulnerability, allowing unrestricted code execution.

Attack Vector

The attack vector is network-based, targeting the /api/remote endpoint. An attacker can send a crafted HTTP request containing malicious Python code embedded within what should be JSON data. When the server processes this request using eval(), the malicious code executes on the server.

For example, instead of sending legitimate JSON like {"key": "value"}, an attacker could send a payload that imports system modules and executes shell commands. The attacker could leverage Python's os module to run system commands, the subprocess module to spawn processes, or even establish reverse shells for persistent access.

For detailed technical analysis and proof-of-concept information, refer to the CERT Poland advisory.

Detection Methods for CVE-2025-0868

Indicators of Compromise

• Unusual HTTP POST requests to the /api/remote endpoint containing Python code syntax such as import, os.system, subprocess, exec, or __import__
• Server processes spawning unexpected child processes or shell commands
• Outbound network connections initiated by the DocsGPT application process to unusual destinations
• Unexpected file modifications or new files created in the application directory

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing Python code patterns in JSON payloads
• Monitor application logs for requests to /api/remote with suspicious payloads or unusual request sizes
• Deploy network intrusion detection systems (NIDS) with signatures for common Python RCE payloads
• Enable process monitoring to detect the DocsGPT application spawning unexpected child processes

Monitoring Recommendations

• Establish baseline behavior for the DocsGPT application and alert on deviations such as new network connections or process spawning
• Configure SIEM rules to correlate web requests to /api/remote with subsequent suspicious system activity
• Implement application-level logging to capture all requests to the vulnerable endpoint for forensic analysis
• Monitor system integrity on servers running DocsGPT for unauthorized modifications

How to Mitigate CVE-2025-0868

Immediate Actions Required

• Upgrade DocsGPT to a version newer than 0.12.0 that addresses this vulnerability
• If immediate upgrade is not possible, restrict network access to the /api/remote endpoint using firewall rules or reverse proxy configurations
• Place DocsGPT instances behind authentication if not already configured
• Implement network segmentation to limit the potential impact of successful exploitation

Patch Information

Organizations running DocsGPT versions 0.8.1 through 0.12.0 should upgrade to the latest available version immediately. Check the GitHub DocsGPT Repository for the latest release that addresses this vulnerability. Review the CERT Poland advisory for additional technical details and remediation guidance.

Workarounds

• Disable or block access to the /api/remote endpoint at the web server or reverse proxy level if the functionality is not required
• Implement a web application firewall rule to block requests containing Python code patterns targeting the vulnerable endpoint
• Restrict access to the DocsGPT application to trusted internal networks only until patching is complete
• Run DocsGPT in a containerized environment with minimal privileges to limit the impact of potential exploitation

# Example: Block access to vulnerable endpoint using nginx
location /api/remote {
    deny all;
    return 403;
}

# Example: Restrict access to internal networks only
location /api/remote {
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;
}