{"id":"CVE-2026-120203","title":"ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates","summary":"ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escap…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-94"],"vendor":"ShowDoc","product":"ShowDoc","affected":["ShowDoc >= 2.8.14 < 3.9.6"],"published":"2026-10-31","updated":"2026-10-31","sourceUpdated":"2026-10-31T17:25:52.170Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120203","references":[{"url":"https://github.com/star7th/showdoc/commit/5a2087a3f408f5266f61e9e2fb98845ef4788288","label":"Patch Commit"},{"url":"https://gist.github.com/LioTree/028af150fd991cf9924dd2c7d5912e54"},{"url":"https://github.com/star7th/showdoc/blob/v3.9.5/mock/index.js#L42"},{"url":"https://github.com/star7th/showdoc"},{"url":"https://www.vulncheck.com/advisories/showdoc-2.8.14-before-3.9.6-code-injection-via-mock-templates","label":"VulnCheck Advisory: ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates"}],"tags":["cve.org"],"epss":0.00352,"epssPercentile":0.28971,"ingestedAt":"2026-11-05T17:27:38.378Z","slug":"CVE-2026-120203","body":"## Overview\n\nShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.\n\n## Affected\n\n- `ShowDoc >= 2.8.14 < 3.9.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}