DocsGPT, a GPT‑powered chat for documentation, contains a flaw that allows an unauthenticated attacker to exploit the MCP STDIO configuration. By crafting a malicious payload that bypasses the intended "MCP test" verification, an attacker can inject and execute arbitrary shell commands. This leads to full remote code execution on the host running DocsGPT, compromising confidentiality, integrity, and availability. The weakness is a command injection flaw identified as CWE‑77.

The affected component is arc53’s DocsGPT. Versions from 0.15.0 up to, but not including, 0.16.0 are vulnerable. Any local or public deployment of these releases, including the official website, is susceptible. Upgrading to version 0.16.0 or newer removes the flaw.

The CVSS base score of 10.0 marks this as a critical vulnerability. No EPSS data is provided, so the probability of exploitation cannot be quantified, but the absence of authentication and the nature of the command injection imply a high likelihood of successful attacks. It is not listed in the CISA KEV catalog, yet the remote code execution capability warrants immediate attention. Exploitation requires only network access to the DocsGPT interface and no administrative privileges.