{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/showdoc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:showdoc:showdoc:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-120203"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ShowDoc (2.8.14 \u003c= version \u003c 3.9.6)"],"_cs_severities":["high"],"_cs_tags":["webserver","rce","injection"],"_cs_type":"advisory","_cs_vendors":["ShowDoc"],"content_html":"\u003cp\u003eShowDoc 2.8.14 through 3.9.5 contains a code injection vulnerability in its Mock feature, tracked as CVE-2026-120203. Authenticated users can inject malicious shell commands into mockjs templates via the MockController::add endpoint. When these templates are subsequently processed via MockController::infoByKey, the application uses eval() to execute the embedded code, leading to command execution with root privileges in default Docker deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the ShowDoc application.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious mockjs template containing shell commands.\u003c/li\u003e\n\u003cli\u003eAttacker submits the payload via the MockController::add endpoint.\u003c/li\u003e\n\u003cli\u003eThe malicious template is stored in the application database.\u003c/li\u003e\n\u003cli\u003eAttacker triggers execution by accessing the MockController::infoByKey endpoint.\u003c/li\u003e\n\u003cli\u003eThe application processes the template using eval(), executing the payload as root.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary command execution with root privileges when the application is running in the official Docker environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade ShowDoc to version 3.9.6 or later to address the vulnerable Mock feature.\u003c/p\u003e\n","date_modified":"2026-10-31T22:05:36Z","date_published":"2026-10-31T22:05:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-showdoc-code-injection/","summary":"ShowDoc versions 2.8.14 through 3.9.5 are vulnerable to authenticated remote code execution via a code injection flaw in the Mock feature's template processing.","title":"ShowDoc: Remote code execution in Mock feature (CVE-2026-120203)","url":"https://feed.craftedsignal.io/briefs/2026-10-showdoc-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - ShowDoc","version":"https://jsonfeed.org/version/1.1"}