In the affected version of DocsGPT, a custom prompt feature renders user supplied content through the Jinja templating engine without sanitizing or sandboxing. This permits an unauthenticated user to inject arbitrary Jinja expression, which the server evaluates. The injection can be used to execute arbitrary code on the host, providing full remote code execution. The flaw stems from a critical input validation weakness that allows malicious template processing. The analysis infers that no additional authentication checks or security boundaries are applied, as the description does not mention any such mechanisms.

The issue exists in DocsGPT version 0.15.0 and earlier. Any installation of these releases that continues to expose the custom prompt setting is vulnerable. The analysis infers that the vulnerability affects any instance that has the custom prompt feature enabled, regardless of external configuration, because the advisory does not limit exposure.

The vulnerability can be exploited without authentication or elevated privileges, making it trivial for an attacker to gain full control of the affected machine. The CVSS score of 9.8 indicates a very high severity. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog. The lack of EPSS data and KEV listing indicates no publicly reported exploitation, but the high CVSS suggests that if an attacker can reach the vulnerable endpoint, exploitation is straightforward.