Code Injection Vulnerability in ShowDoc by Star7th
CVE-2026-120203

8.7HIGH

Key Information:

Vendor

Showdoc

Status
Showdoc
Vendor
CVE Published:
31 October 2026

What is CVE-2026-120203?

The Mock feature in ShowDoc versions 2.8.14 and earlier contains a vulnerability that allows authenticated users to perform code injection attacks. By exploiting this flaw, attackers can store malicious mockjs templates utilizing escaped parentheses. When these templates are evaluated through the application's MockController, they are executed as shell commands with root privileges on the official Docker image of ShowDoc. This poses a significant security risk, enabling unauthorized command execution.

Affected Version(s)

ShowDoc 2.8.14 < 3.9.6

References

https://github.com/star7th/showdoc/commit/5a2087a3f408f52...
patch
https://gist.github.com/LioTree/028af150fd991cf9924dd2c7d...
technical-description
https://github.com/star7th/showdoc/blob/v3.9.5/mock/index...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LionTree
star7th
.