CRITICALCVE-2026-26015Published Modified CNA GitHub_M
CVE-2026-26015: Unauthenticated RCE in DocsGPT MCP STDIO Configuration
DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.
Metrics
- CVSS v4.0
- 10.0
- Severity
- CRITICAL
- Fixed in
- —
- Affected Products
- 1
Affected packages
- arc53 / DocsGPT>= 0.15.0, < 0.16.0
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H