{"id":"CVE-2026-65973","kind":"vulnerability","aliases":["CVE-2026-65973"],"related":[],"title":"Laradocs: unescaped Node.js path lets local users inject commands","description":"Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a proc_open() command string. This issue has been patched in version 1.0.0.","summary":"Laradocs, a documentation tool for Laravel projects, builds a shell command string with an unescaped Node.js binary path when rendering KaTeX math on the server. A party who can control that path can run arbitrary commands on the host running the render.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["laradocs","laravel","package","php"],"not_affected_if":["no-server-side-katex","version-1.0.0-or-later"],"how_to_check":"- Check the installed Laradocs version in the project's `composer.lock` for `laradocs` at a version from `0.4.0` up to, but not including, `1.0.0`.\n- Confirm whether the KaTeX server-side rendering path is used, which the sources do not describe in detail.","fix":"- Laradocs: upgrade to `1.0.0` or later.","status":"open","published_at":"2026-11-11T21:16:46+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","triaged_at":"2026-11-11T21:30:52+00:00","updated_at":"2026-11-11T21:30:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T21:30:52Z","model":"claude-haiku-5-5","output":{"fix":"- Laradocs: upgrade to `1.0.0` or later.","reach":"local","title":"Laradocs: unescaped Node.js path lets local users inject commands","impact":"high","summary":"Laradocs, a documentation tool for Laravel projects, builds a shell command string with an unescaped Node.js binary path when rendering KaTeX math on the server. A party who can control that path can run arbitrary commands on the host running the render.","audience":"developers","category":"package","nicknames":[],"who_cares":["laravel","php","laradocs"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Commands run on the server under the web application's user.","analyst_note":"Product ranges name Laradocs only in the description; the vendor advisory and release notes linked from the signal were not read for exact conditions.','product_name':","how_to_check":"- Check the installed Laradocs version in the project's `composer.lock` for `laradocs` at a version from `0.4.0` up to, but not including, `1.0.0`.\n- Confirm whether the KaTeX server-side rendering path is used, which the sources do not describe in detail.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.0.0-or-later","no-server-side-katex"],"who_is_affected":"Teams running Laradocs from version 0.4.0 up to but not including 1.0.0 in a Laravel codebase where server-side KaTeX rendering runs. The flaw needs a path value that an attacker can influence, so exposure depends on how the Node.js binary path is configured; the sources do not say who controls it in typical setups.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4584,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-65973':12A,15A '0.4.0':74C '1.0.0':78C,111C 'arbitrari':54B 'binari':36B,96C 'build':27B 'codebas':71C 'command':9A,30B,55B,84C,102C 'control':49B,66C 'cve':10A,13A 'document':22B,67C 'host':58B 'inject':8A,85C 'insid':68C 'issu':105C 'katex':40B,90C 'laradoc':1A,16B,20B,62C,79C 'laravel':17B,25B,70C 'let':5A 'local':6A,83C 'maintain':63C 'math':41B 'node.js':3A,35B,95C 'open':101C 'packag':18B 'parti':46B 'patch':108C 'path':4A,37B,51B,97C 'php':19B 'proc':100C 'project':26B 'render':39B,61B,91C 'run':53B,59B 'server':44B,88C 'server-sid':87C 'shell':29B 'side':89C 'string':31B,103C 'tool':23B 'unescap':2A,34B,94C 'user':7A 'version':65C,73C,77C,110C 'version-control':64C 'via':92C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams running Laradocs from version 0.4.0 up to but not including 1.0.0 in a Laravel codebase where server-side KaTeX rendering runs. The flaw needs a path value that an attacker can influence, so exposure depends on how the Node.js binary path is configured; the sources do not say who controls it in typical setups.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["laradocs","laravel","medium","package","php"],"campaign_type":null,"search_a":"'-2026':11A,14A '-65973':12A,15A 'command':9A 'cve':10A,13A 'inject':8A 'laradoc':1A 'let':5A 'local':6A 'node.js':3A 'path':4A 'unescap':2A 'user':7A","search_b":"'arbitrari':54B 'binari':36B 'build':27B 'command':30B,55B 'control':49B 'document':22B 'host':58B 'katex':40B 'laradoc':16B,20B 'laravel':17B,25B 'math':41B 'node.js':35B 'packag':18B 'parti':46B 'path':37B,51B 'php':19B 'project':26B 'render':39B,61B 'run':53B,59B 'server':44B 'shell':29B 'string':31B 'tool':23B 'unescap':34B","search_c":"'0.4.0':74C '1.0.0':78C,111C 'binari':96C 'codebas':71C 'command':84C,102C 'control':66C 'document':67C 'inject':85C 'insid':68C 'issu':105C 'katex':90C 'laradoc':62C,79C 'laravel':70C 'local':83C 'maintain':63C 'node.js':95C 'open':101C 'patch':108C 'path':97C 'proc':100C 'render':91C 'server':88C 'server-sid':87C 'side':89C 'string':103C 'unescap':94C 'version':65C,73C,77C,110C 'version-control':64C 'via':92C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T23:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65973","severity":null,"published_at":"2026-11-11T21:16:46+00:00","modified_at":"2026-11-11T21:16:46+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","fetched_at":"2026-11-11T21:29:09+00:00","note":null}],"documents":[{"id":129015,"url":"https://github.com/PeteBishwhip/laradocs/releases/tag/v1.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129016,"url":"https://github.com/PeteBishwhip/laradocs/security/advisories/GHSA-h746-qpxh-ph7g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T23:17:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}