External risk intelligence

DocsGPT Server-Side Template Injection Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-31020

DocsGPT is a chatbot application typically deployed as a public-facing web service or API endpoint to facilitate user interactions. Given its role as a customer-facing or internal-facing web application, it is commonly accessible via the internet or through an organization's network edge, making the vulnerable prompt feature reachable.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in DocsGPT, an application that uses custom prompts for chatbot interactions. This issue could allow an unauthenticated attacker to execute arbitrary code on the server, potentially impacting the application's availability and integrity. The main concern at this time is confirming whether our deployed instances are relevant and exposed.

Malicious prompts can run unauthorized code.
Critical flaw could expose sensitive systems.
Verify relevance and exposure of this tool.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input to the custom prompt feature of DocsGPT. Because this feature processes user input using unescaped templates, an attacker can insert malicious code that the server will execute. This could allow an attacker to take complete control of the server.

No authentication is required to trigger.
Injecting malicious template expressions.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server when interacting with the custom prompt feature. This could affect the application's availability and integrity.

Server code execution.
Via malicious prompt injection.
Compromise of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner or platform team responsible for DocsGPT should initiate the response to this critical vulnerability. The first practical step is to identify all instances of the affected technology, confirm their reachability and business criticality, and then assign ownership for remediation planning based on assessed risk.

Application owner should triage.
Verify application reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DocsGPT?

DocsGPT is an open-source chatbot application designed to interact with documentation. It uses generative AI to answer user queries by processing information from provided files or knowledge bases. The platform typically functions as a web service where users or organizations integrate it into their workflows to automate support or information retrieval, often utilizing custom prompt configurations to tailor how the bot responds to specific inquiries.

What does CVE-2026-31020 mean for DocsGPT?

This vulnerability is classified as Improper Control of Generation of Code, or CWE-94. In plain terms, the application's feature for custom prompts fails to clean or isolate user-provided text before processing it. Because it uses Jinja templates to handle this data, an attacker can input special commands that the server interprets as instructions, which leads to arbitrary remote code execution on the underlying system.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the custom prompt feature of the chatbot and inserting malicious template expressions. The vulnerability does not require any specialized knowledge or valid user account, as it is accessible without authentication. Simply navigating to the prompt configuration interface and providing crafted input is sufficient; legitimate chatbot queries that do not utilize these specific template-processing features do not trigger the flaw.

How relevant is this threat to my organization?

Halo Surface Signal indicates that because DocsGPT is commonly deployed as a public-facing web service or API endpoint, it is highly likely to be reachable from the internet. If your instance is exposed to the network edge, the risk is higher. You should assess whether your specific deployment is accessible externally or if it is restricted to internal users, as that affects the immediate reachability of the vulnerable prompt feature.

What should I do if I run DocsGPT?

Your first step is to locate every instance of DocsGPT within your environment to understand your total footprint. Once identified, confirm which instances are accessible to outside traffic versus internal networks. Prioritize triage based on the business importance of each service, and coordinate with the relevant platform or application teams to determine the necessary updates or configuration changes to secure the custom prompt functionality.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.