ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
ShowDoc ShowDoc unaffected
Version Status Constraints
2.8.14 affected < 3.9.6

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Showdoc Subscribe
Showdoc Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://gist.github.com/LioTree/028af150fd991cf9924dd2c7d5912e54 cve-icon cve-icon
https://github.com/star7th/showdoc cve-icon cve-icon
https://github.com/star7th/showdoc/blob/v3.9.5/mock/index.js#L42 cve-icon cve-icon
https://github.com/star7th/showdoc/commit/5a2087a3f408f5266f61e9e2fb98845ef4788288 cve-icon cve-icon
https://www.vulncheck.com/advisories/showdoc-2.8.14-before-3.9.6-code-injection-via-mock-templates cve-icon cve-icon
History

Sat, 31 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.
Title ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates
First Time appeared Showdoc
Showdoc showdoc
Weaknesses CWE-94
CPEs cpe:2.3:a:showdoc:showdoc:*:*:*:*:*:*:*:*
Vendors & Products Showdoc
Showdoc showdoc
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-31T17:25:52.170Z

Reserved: 2026-10-31T11:44:47.454Z

Link: CVE-2026-120203

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-31T18:17:08.237

Modified: 2026-10-31T18:17:08.237

Link: CVE-2026-120203

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-31T19:30:13Z

Weaknesses