Loading vulnerability…
CVE-2025-0868 is a remote code execution vulnerability in Arc53 DocsGPT affecting versions 0.8.1 through 0.12.0. The flaw is caused by improper parsing of JSON data using Python's eval(), allowing attacker-controlled input to be interpreted and executed as Python code. An unauthenticated attacker can reach the vulnerable /api/remote endpoint and supply crafted input that results in arbitrary code execution on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a working exploit for CVE-2025-0868, a critical remote code execution (RCE) vulnerability in DocsGPT versions 0.8.1 through 0.12.0. The vulnerability arises from unsafe use of Python's eval() function on user-supplied JSON data in the /api/remote endpoint, allowing unauthenticated attackers to execute arbitrary Python code on the server. The repository includes a Python script (CVE-2025-0868.py) that sends a crafted POST request to the vulnerable endpoint, injecting a payload that executes an OS command (touch /tmp/test) on the target. The README.md provides a detailed technical analysis, exploitation steps, and mitigation advice. The exploit is operational and demonstrates real code execution, but the payload can be easily modified for more destructive actions. The main fingerprintable endpoint is the /api/remote HTTP API, and the exploit demonstrates successful code execution by creating a file on the target system.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability identified as CVE-2025-0868 has been referenced by the addition of a detection template in the nuclei-templates repository. No further technical details or impact information is provided in the content.
A remote code execution vulnerability in Arc53 DocsGPT caused by improper parsing of JSON data using Python eval() in the /api/remote endpoint, enabling an unauthenticated attacker to execute arbitrary Python code.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.