CVE-2026-65973 · Package
NO FIX YET · SEE WHAT TO DO
Laradocs, a documentation tool for Laravel projects, builds a shell command string with an unescaped Node.js binary path when rendering KaTeX math on the server. A party who can control that path can run arbitrary commands on the host running the render.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Laradocs from version 0.4.0 up to but not including 1.0.0 in a Laravel codebase where server-side KaTeX rendering runs. The flaw needs a path value that an attacker can influence, so exposure depends on how the Node.js binary path is configured; the sources do not say who controls it in typical setups.
Not affected if no-server-side-katex, version-1.0.0-or-later
Who cares laradocs, laravel, php
composer.lock for laradocs at a version from 0.4.0 up to, but not including, 1.0.0.1.0.0 or later.Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a proc_open() command string. This issue has been patched in version 1.0.0.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.