PT-2026-35960 · Docsgpt · Docsgpt

Mosesox · Published 2026-04-29 · Updated 2026-05-11 · CVE-2026-26015

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions DocsGPT versions 0.15.0 through 0.15.x

Description An attacker accessing the official website or any local and public deployment can craft a malicious payload that bypasses the "MCP test" behavior to achieve arbitrary remote code execution (RCE), which is the ability to execute any command on the target machine.

Recommendations Update to version 0.16.0.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-26015

Affected Products

Docsgpt

References · 7

• 🔥 https://github.com/arc53/DocsGPT/security/advisories/GHSA-gcrq-f296-2j74 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26015 · Security Note
• https://github.com/arc53/DocsGPT/releases/tag/0.16.0 · Note
• https://ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp · Note
• https://twitter.com/CVEnew/status/2049578383009616087 · Twitter Post
• https://twitter.com/lyrie_ai/status/2053672842554695934 · Twitter Post
• https://ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem · Note