DocsGPT Server-Side Template Injection Leading to RCE

Technical Analysis

The entry point is the custom prompt configuration field intended to let users tailor chatbot behavior; this field is passed into a Jinja templating engine without sandboxing (e.g., no restricted environment, no autoescape-equivalent for code execution) or input validation. An attacker supplies Jinja expression syntax that the template engine evaluates server-side, reaching Python builtins and ultimately OS command execution. Because the feature requires no authentication, any external party can reach this path directly, crossing the boundary from 'prompt configuration data' into the application's execution environment. This effectively turns an LLM-adjacent customization feature into a full server compromise primitive, which can then be used to poison the agent's tools, exfiltrate data, or pivot to other internal systems the DocsGPT instance can reach.

Affected Systems

DocsGPT

Detection Signatures

• Requests to custom-prompt / prompt-configuration endpoints containing Jinja delimiters such as {{ }}, {% %}, or {# #}
• Unexpected use of Python builtin/class introspection tokens (e.g., __class__, __mro__, __subclasses__, __globals__) in prompt fields or logs
• Unauthenticated POST/PUT requests to prompt management endpoints from unfamiliar IPs
• Unexpected child processes spawned by the DocsGPT application process
• Outbound connections from the DocsGPT host shortly after a prompt-update request

Remediation Steps

1. 1

   Upgrade DocsGPT

   Update to a patched DocsGPT release beyond 0.15.0 once available; track vendor advisories for the fix version.

2. 2

   Sandbox template rendering

   Use a sandboxed Jinja environment (e.g., SandboxedEnvironment) and disallow access to Python builtins, attribute chains, and dangerous filters when rendering user-supplied prompt content.

3. 3

   Input validation/allowlisting

   Restrict custom prompt input to plain text or a constrained templating subset; strip or reject Jinja control/delimiter syntax from user input.

4. 4

   Require authentication and authorization

   Gate the custom prompt feature behind authenticated, authorized sessions and rate-limit configuration changes.

5. 5

   Least-privilege deployment

   Run the DocsGPT application with a minimal-privilege service account and container isolation to limit blast radius if RCE occurs.

6. 6

   Network monitoring and WAF rules

   Deploy WAF rules to detect Jinja/SSTI payload patterns in requests to prompt-related endpoints and alert on anomalous outbound traffic.