CVE-2026-26015
Unauthenticated RCE in DocsGPT MCP STDIO Configuration
Summary
Unauthenticated RCE in DocsGPT MCP STDIO Configuration
Original description
The description as published by the source.
DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory ox.security
- web github.com
- web ox.security