CVE-2025-0868

This exploit demonstrates a Remote Code Execution (RCE) vulnerability in DocsGPT versions 0.8.1 through 0.12.0. It sends a maliciously crafted POST request to the `/api/remote` endpoint, injecting a payload that executes arbitrary commands via Python's `__import__('os').system()` function.

The repository contains a functional exploit for CVE-2026-22812, demonstrating remote command execution (RCE) in OpenCode. The script sends a crafted JSON payload to the '/session' endpoint to obtain a session ID, then executes the 'id' command via the '/session/{id}/shell' endpoint.

This repository contains a functional Python exploit for CVE-2025-0868, an RCE vulnerability in DocsGPT versions 0.8.1 through 0.12.0. The exploit leverages unsafe `eval()` usage in the `/api/remote` endpoint to execute arbitrary Python code via crafted JSON input.