ShowDoc: Code injection via Mock templates
Summary
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature. An authenticated user can store a crafted mockjs template that is evaluated with eval() and run operating system commands. According to the sources, the commands run as root in the official Docker image, and the trigger endpoint does not require authentication.
Affected
- ShowDoc 2.8.14 to before 3.9.6 (according to the VulnCheck CNA record)
- Official Docker image star7th/showdoc:v3.9.4 and v3.9.5 (verified in a public write-up)
- Affected only if the Mock service is enabled (enabled by default in the official full image)
Fixed in
- Upgrade to ShowDoc 3.9.6 or later
- Backports to older branches: Unknown.
Workaround
- No vendor workaround known.
- Unknown.
Exploitation
- Exploited in the wild: Not known.
- Public proof of concept: None found at the time of writing.
- The vulnerable code and fix commit are public, so exploit development is possible.
Our recommendation
- Upgrade ShowDoc to version 3.9.6 or later.
- Check whether a ShowDoc instance is reachable from the internet and disable open self-registration if possible.
- Restrict accounts to trusted users and review existing accounts.
- Review stored Mock templates and the logs for unexpected entries.
- Do not run the container as root and limit its network access.
- Priority: high if internet-exposed or open registration is enabled, otherwise medium.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Fix commit 5a2087a github.com
- Vulnerable code mock/index.js (v3.9.5) github.com
- Technical write-up (gist) gist.github.com
- ShowDoc GitHub repository github.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:13.
Original description (NVD)
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.
NVD references (5)
- https://gist.github.com/LioTree/028af150fd991cf9924dd2c7d5912e54
- https://github.com/star7th/showdoc
- https://github.com/star7th/showdoc/blob/v3.9.5/mock/index.js#L42
- https://github.com/star7th/showdoc/commit/5a2087a3f408f5266f61e9e2fb98845ef4788288
- https://www.vulncheck.com/advisories/showdoc-2.8.14-before-3.9.6-code-injection-via-mock-templates
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.