CVE-2026-31020: In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content

DocsGPT version 0.15.0 and below has a security flaw in its custom prompt feature that fails to validate user input before processing it with Jinja templates (a system for dynamically generating text). An attacker can inject malicious code into this feature to perform server-side template injection (SSTI, a technique where an attacker tricks the server into executing unintended code), potentially gaining full remote code execution (RCE, the ability to run any command on the server).