CVE-2026-120203
Received Received - Intake

Code Injection in ShowDoc via MockJS Templates

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: VulnCheck

Description
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-120203
EUVD
EUVD-2026-114724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ShowDoc ShowDoc 2.8.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120203 is a code injection vulnerability in ShowDoc versions 2.8.14 through 3.9.5 affecting the Mock feature. Authenticated users can exploit it by storing malicious mockjs templates that execute shell commands via JavaScript's eval() function. The Node.js mock service processes these templates without proper validation, allowing command execution with root privileges in the official Docker image.

Detection Guidance

Check ShowDoc versions between 2.8.14 and 3.9.5. Inspect mock templates for suspicious payloads using Unicode escape sequences or child_process module calls. Review logs for unauthorized POST requests to /mock endpoints or unexpected command executions.

Impact Analysis

An attacker could gain full control over the ShowDoc server, including access to the application directory, SQLite database, and container network. This could lead to data theft, unauthorized modifications, or further network compromise. The impact is severe due to root-level access in Docker deployments.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR) and healthcare data security (HIPAA) due to unauthorized access to sensitive data. Organizations using vulnerable versions risk data breaches, leading to potential fines and regulatory penalties for failing to protect user data.

Mitigation Strategies

Upgrade ShowDoc to version 3.9.6 or later. Disable the Mock feature if unused. Implement strict input validation for mock templates. Run the mock service as a non-root user. Add authorization checks for template creation and access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart