CVE-2026-31020: DocsGPT SSTI Remote Code Execution Flaw

CVE-2026-31020 Overview

CVE-2026-31020 is a server-side template injection (SSTI) vulnerability in DocsGPT version 0.15.0 and below. The application exposes a custom prompt feature that renders user-supplied content through Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions into the prompt input. Successful exploitation results in arbitrary remote code execution (RCE) on the underlying server. The flaw is categorized under [CWE-94] Improper Control of Generation of Code. Because no authentication or user interaction is required, the vulnerability is exploitable directly over the network against exposed DocsGPT instances.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on DocsGPT servers by injecting Jinja template expressions into the custom prompt feature.

Affected Products

• DocsGPT 0.15.0
• All DocsGPT releases prior to 0.15.0
• Arc53 DocsGPT deployments exposing the custom prompt endpoint

Discovery Timeline

• 2026-09-04 - CVE-2026-31020 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-31020

Vulnerability Analysis

DocsGPT is an open-source documentation chatbot developed by Arc53. The application allows users to define custom prompts that shape chatbot responses. The prompt payload is passed directly into the Jinja templating engine for rendering at request time.

Jinja evaluates any expression enclosed in {{ }} or {% %} delimiters. When user input reaches the renderer without sanitization or sandboxing, attackers can traverse the Python object graph exposed by template globals. This traversal reaches built-in classes such as subprocess.Popen or os.system, enabling arbitrary command execution in the DocsGPT process context.

Because the custom prompt endpoint is reachable without authentication, exploitation requires only network access to the vulnerable service. See the GitHub CVE-2026-31020 Repository for proof-of-concept details.

Root Cause

The root cause is unsanitized rendering of attacker-controlled input through Jinja templates. DocsGPT does not apply a sandboxed environment such as jinja2.sandbox.SandboxedEnvironment, nor does it strip template delimiters from prompt content. The rendering call trusts the prompt string as a template rather than treating it as literal data.

Attack Vector

An attacker sends a crafted HTTP request to the DocsGPT prompt endpoint containing Jinja expression syntax. The server renders the payload, evaluates the embedded Python expressions, and returns the output. Payloads typically walk __class__, __mro__, and __subclasses__ to reach OS command execution primitives. No credentials, tokens, or user interaction are required.

No verified public exploit code is referenced in the CVE record. Refer to the GitHub CVE-2026-31020 Repository and the Arc53 Homepage for further technical context.

Detection Methods for CVE-2026-31020

Indicators of Compromise

• HTTP request bodies to DocsGPT prompt endpoints containing Jinja delimiters such as {{, }}, {%, or %}
• Requests referencing Python introspection attributes including __class__, __mro__, __subclasses__, __globals__, or __builtins__
• Unexpected child processes spawned by the DocsGPT application user, particularly sh, bash, curl, wget, or python
• Outbound network connections initiated by the DocsGPT process to unknown hosts

Detection Strategies

• Inspect application and reverse-proxy logs for prompt payloads containing template expression syntax.
• Alert on process-lineage anomalies where the DocsGPT service parent spawns shell interpreters or network tools.
• Deploy web application firewall rules that flag Jinja and Python dunder patterns in request bodies targeting DocsGPT paths.

Monitoring Recommendations

• Enable verbose logging of the custom prompt endpoint including full request bodies for forensic review.
• Monitor egress traffic from DocsGPT hosts for reverse shell or data exfiltration patterns.
• Track filesystem writes to sensitive directories such as /etc, /root, and the DocsGPT working directory.

How to Mitigate CVE-2026-31020

Immediate Actions Required

• Restrict network exposure of DocsGPT instances to trusted internal networks or behind authenticated reverse proxies.
• Disable the custom prompt feature until a patched release is deployed.
• Audit existing DocsGPT deployments for prior exploitation by reviewing prompt logs and process telemetry.
• Rotate any credentials, API keys, or tokens accessible from the DocsGPT runtime environment.

Patch Information

At the time of publication, no fixed version is listed in the CVE record. Monitor the Arc53 Homepage and the DocsGPT project repository for a security release addressing versions 0.15.0 and below. Upgrade to the first release that introduces sandboxed template rendering or removes Jinja evaluation of user-supplied prompts.

Workarounds

• Place DocsGPT behind an authenticating reverse proxy and deny anonymous access to prompt endpoints.
• Apply WAF rules that block request payloads containing {{, }}, {%, %}, and Python dunder attribute references.
• Run the DocsGPT container as an unprivileged user with a read-only filesystem and no outbound internet access to limit RCE impact.
• Fork and patch the prompt renderer to use jinja2.sandbox.SandboxedEnvironment or to treat prompt content as literal strings.

# Example WAF rule concept for blocking Jinja SSTI payloads targeting DocsGPT
# ModSecurity-style pattern
SecRule REQUEST_URI "@beginsWith /api/prompt" \
  "phase:2,deny,status:403,id:1026031020,\
   msg:'Potential CVE-2026-31020 SSTI attempt against DocsGPT',\
   chain"
  SecRule REQUEST_BODY "@rx (\{\{|\{%|__class__|__mro__|__subclasses__|__globals__)" \
    "t:none,t:lowercase"