ShowDoc: Remote code execution in Mock feature (CVE-2026-120203)

ShowDoc 2.8.14 through 3.9.5 contains a code injection vulnerability in its Mock feature, tracked as CVE-2026-120203. Authenticated users can inject malicious shell commands into mockjs templates via the MockController::add endpoint. When these templates are subsequently processed via MockController::infoByKey, the application uses eval() to execute the embedded code, leading to command execution with root privileges in default Docker deployments.

Attack Chain

1. Attacker authenticates to the ShowDoc application.
2. Attacker crafts a malicious mockjs template containing shell commands.
3. Attacker submits the payload via the MockController::add endpoint.
4. The malicious template is stored in the application database.
5. Attacker triggers execution by accessing the MockController::infoByKey endpoint.
6. The application processes the template using eval(), executing the payload as root.

Impact

Successful exploitation allows for arbitrary command execution with root privileges when the application is running in the official Docker environment.

Recommendation

Upgrade ShowDoc to version 3.9.6 or later to address the vulnerable Mock feature.