Vulnerability · Published Oct 31, 2026 · Assigned by VulnCheck

CVE-2026-120203ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates

High 8.8

In plain English

A high-severity code injection in ShowDoc from ShowDoc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 71.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.

Affected products (as reported)

Vendor	Product	Versions
ShowDoc	ShowDoc	2.8.14 – before 3.9.6

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patch Commit patch
https://gist.github.com/LioTree/028af150fd991cf9924dd2c7d5912e54 technical-description
https://github.com/star7th/showdoc/blob/v3.9.5/mock/index.js#L42 technical-description
https://github.com/star7th/showdoc product
VulnCheck Advisory: ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates third-party-advisory