Vulnerabilities

TI-2026-61924 CVE-2026-91201 · GHSA-x85x-q6hq-hm4x

DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

LOW 23

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00208 Published 2026-09-14 No fix listed CWE-346

TI-2026-11409 CVE-2026-13483 · GHSA-v4h4-747p-qjgx

arc53 DocsGPT Credential Storage encryption.py encrypt_credentials data authenticity

MEDIUM 45

A flaw has been found in arc53 DocsGPT up to 0.18.0.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00128 Published 2026-06-28 No fix listed CWE-345

TI-2026-21029 CVE-2026-26015

Unauthenticated RCE in DocsGPT MCP STDIO Configuration

HIGH 82

DocsGPT is a GPT-powered chat for documentation.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01168 Published 2026-04-29 Fixed in 0.16.0 CWE-77

TI-2025-00736 CVE-2025-0868 · GHSA-9gff-5v8w-x922

Remote Code Execution in DocsGPT

HIGH 65

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.17087 Published 2025-02-20 No fix listed CWE-95

TI-2024-20815 CVE-2024-31451

Limited file write in routes.py (GHSL-2023-250)

LOW 31