Read the docs
TI-2026-83553 Aliases CVE-2026-120203GHSA-fm4v-42hr-rpgp

Code injection in ShowDoc Mock templates lets users run commands

Priority MEDIUM 40CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

ShowDoc from 2.8.14 before 3.9.6 contains a code injection flaw (CWE-94) in its Mock feature. An authenticated user can store a crafted mockjs template that the server evaluates with eval(), so the user can run shell commands on the host. The commands run as root in the official Docker image.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Fixed ShowDoc (ShowDoc): 3.9.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
star7thShowDoc2.8.14 to before 3.9.63.9.6Patch availableCNA
  • ShowDoc Vendorstar7th Affected 2.8.14 to before 3.9.6 Fixed in 3.9.6 Patch available CNA

Remediation

The fixed version is ShowDoc 3.9.6.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA ShowDoc (ShowDoc) Fixed in 3.9.6

Timeline

  1. 2026-10-31 Threatist record created from CVE-2026-120203
  2. 2026-10-31 Alias added: GHSA-fm4v-42hr-rpgp
  3. 2026-11-02 Priority changed: MEDIUM → LOW
  4. 2026-11-06 CISA SSVC decision points changed
  5. 2026-11-06 Priority changed: LOW → MEDIUM

References

Patch 1

Other 3

  • TI-2025-00432 ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution CVSS 4.0CRITICAL 9.4
  • TI-2026-59246 star7th showdoc API Page Save Endpoint editormd.js cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2021-14768 Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary… CVSS 3.1CRITICAL 9.8
  • TI-2022-00287 SQL Injection in star7th/showdoc CVSS 3.1CRITICAL 9.8
  • TI-2021-18398 ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions. CVSS 3.1CRITICAL 9.8
  • TI-2021-03036 Cross-Site Request Forgery (CSRF) in star7th/showdoc CVSS 3.1HIGH 8.8
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences