CVE-2026-26015 is a command injection vulnerability in arc53's DocsGPT product affecting versions 0.15.0 through before 0.16.0. The flaw allows an attacker to craft malicious payloads that bypass the "MCP test" security control, enabling arbitrary remote code execution. This vulnerability applies to both the official DocsGPT website and any local or public deployments of the software. The issue has been addressed and patched in version 0.16.0.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely with no user interaction required. This can lead to full system compromise, including unauthorized access, data manipulation, and service disruption. The vulnerability is critical with a CVSS 4.0 score of 10, reflecting maximum impact on confidentiality, integrity, availability, and security controls.

Upgrade DocsGPT to version 0.16.0 or later, where this command injection vulnerability has been patched. Since this is a self-hosted product and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.