DocsGPT bug lets anyone run code with no login

DocsGPT versions 0.15.0 and earlier run user-supplied custom prompts straight through Jinja with no sanitization and no sandbox, according to NVD's advisory for CVE-2026-31020. Template injection in that path escalates to full remote code execution. No authentication required.

Anyone running a public DocsGPT instance with the custom-prompt feature turned on is exposed with no login wall in front of it. That's the whole attack surface: a text box meant for prompt customization, wired to a template engine that can execute code.

Jinja is built to run inside your own codebase on input you control, not on text a stranger typed into a form. Template engines exist to format developer-written templates, and treating user input as one of those templates is what turns a formatting bug into a code execution bug. That's why sandboxed modes exist for user-facing template rendering, a mode DocsGPT's custom-prompt path apparently skipped.

The advisory doesn't say how long the feature ran unsandboxed before this was reported, or whether a patched release is out. Anyone running DocsGPT publicly with custom prompts enabled should treat the fix as unconfirmed until they check the changelog themselves.

String substitution doesn't have this problem. Neither does a template engine's sandboxed mode, when one exists. The bug shows up specifically when a project reaches for the same full-featured engine it already uses to render its own pages, and hands it end-user text without turning that mode on.