Live › vulnerability › CVE-2026-120203
ShowDoc is a self-hosted API documentation tool. An authenticated user can store a crafted mockjs template that the server evaluates, letting them run shell commands on the server, as root in the official Docker image.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
Teams that self-host ShowDoc between versions 2.8.14 and 3.9.6 are exposed, especially where any user account can reach the Mock feature. Hosted or managed ShowDoc instances are the vendor's responsibility and are not described in the sources. Instances already on 3.9.6 or later are not affected.
No product ranges from the sources yet.
2.8.14 up to but not including 3.9.6.3.9.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.
This page as .md · .json · in your agent: get_signal("CVE-2026-120203")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.