Home / Vulnerability Intelligence / CVE-2026-26015

CVE-2026-26015 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: May 1, 2026

DocsGPT - Remote Code Execution

Published: April 29, 2026Updated: May 1, 2026PoC AvailableRemote Exploitable

Overview

DocsGPT 0.15.0 to < 0.16.0 contains a remote code execution caused by bypassing the MCP test behavior, letting attackers execute arbitrary code remotely, exploit requires attacker to craft a malicious payload.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary code remotely, potentially leading to full system compromise.

Mitigation

Upgrade to version 0.16.0 or later.

References

Social Media Activity(2 posts)

OffSequence

@offseq

Apr 30, 2026

🚨 CRITICAL: CVE-2026-26015 in DocsGPT 0.15.0-0.16.0 enables unauthenticated RCE via command injection (CVSS 10). All deployments at risk — patch to 0.16.0 or later now! https://radar.offseq.com/threat/cve-2026-26015-cwe-77-improper-neutralization-of-s-ba83675d #OffSeq #Vuln #RCE #DocsGPT

View original post

OffSequence

@offseq

Apr 30, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-26015
Severity: Critical
CVSS Score: 9.8
Type: undefined
Status: confirmed
EPSS: 0.0%
Social Posts: 2

CWE

CWE-77

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days