{"cvss":8.8,"datePublished":"2026-11-03T00:00:00Z","dateUpdated":"2026-11-03T00:00:00Z","description":"ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.","dueDate":"","id":"CVE-2026-120203","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"showdoc","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"showdoc showdoc Improper Control of Generation of Code","vendor":"showdoc"}