CVE-2026-26015
Unauthenticated RCE in DocsGPT MCP STDIO Configuration
Résumé
Unauthenticated RCE in DocsGPT MCP STDIO Configuration
Description d'origine
La description telle que publiée par la source (souvent en anglais).
DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory ox.security
- web github.com
- web ox.security