Static Code Injection Vulnerability in Plesk Extensions by Plesk
CVE-2026-68489

8.7HIGH

Key Information:

Vendor

Webpros

Status
Plesk Extension "ruby"
Plesk Extension "node.js Toolkit"
Vendor
CVE Published:
14 September 2026

What is CVE-2026-68489?

A static code injection vulnerability exists in Plesk extensions, specifically the 'Ruby' and 'Node.js Toolkit' versions prior to 1.6.6 and 2.5.0, respectively. This flaw permits remote authenticated users to execute arbitrary code with root privileges through the manipulation of custom environment variables. Properly mitigating this vulnerability is essential to ensure the security and integrity of server environments using these extensions.

Affected Version(s)

Plesk extension "Node.js Toolkit" 0 < 2.5.0

Plesk extension "Ruby" 0 < 1.6.6

References

https://support.plesk.com/hc/en-us/articles/43473204617239

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

d1n4h
.