Static Code Injection in Plesk Ruby and Node.js Toolkit Extensions

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: HackerOne

Description

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-68489

Affected Vendors & Products

Vendor	Product	Version / Range
plesk	ruby	to 1.6.6 (exc)
plesk	node.js_toolkit	to 2.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-96	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

Attack-Flow Graph

Executive Summary

This vulnerability is a static code injection flaw in Plesk extensions 'Ruby' before version 1.6.6 and 'Node.js Toolkit' before version 2.5.0. It allows remote authenticated users to execute arbitrary code with root privileges by manipulating custom environment variables.

Impact Analysis

An attacker with authenticated access could exploit this to run malicious code as the root user on the affected system. This could lead to full system compromise, data theft, unauthorized modifications, or disruption of services.

Mitigation Strategies

Update the Plesk Ruby extension to version 1.6.6 or later and the Node.js Toolkit to version 2.5.0 or later to address the static code injection vulnerability.

Hi! I’m here to help you understand CVE-2026-68489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70