CVE-2026-120203 ShowDoc CVE debrief

Who should care

Defenders responsible for ShowDoc installations, particularly those with authenticated user access, should assess exposure and prioritize patching or mitigation. This includes reviewing the current version of ShowDoc, identifying potentially vulnerable deployments, and planning for updates or mitigations through normal change control. Additionally, defenders should verify ShowDoc versions and restrict access to the Mock feature to authorized users only.

Why it matters

CVE-2026-120203 is a high-severity vulnerability in ShowDoc that allows authenticated users to execute shell commands via mockjs templates, requiring defenders to assess exposure and prioritize patching or mitigation.

• Authenticated users can execute shell commands, potentially leading to system compromise
• Defenders must verify ShowDoc versions and restrict access to the Mock feature
• Patching or mitigating this vulnerability is a high priority due to the high severity of the vulnerability

Technical summary

The vulnerability is caused by the use of eval() in the Mock feature of ShowDoc, which allows authenticated users to execute shell commands by storing a template with escaped parentheses and triggering it through the MockController::infoByKey function. This feature can be exploited by storing a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then triggering it through MockController::infoByKey to run commands, as root in the official Docker image. The vulnerability has a high severity score of 8.7.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, as it allows authenticated users to execute shell commands.

Recommended defensive actions

• Patch or upgrade ShowDoc to version 3.9.6 or later
• Restrict access to the Mock feature to authorized users only
• Monitor for suspicious activity related to the Mock feature
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD, with additional details provided by Vulncheck and other sources. The CVE Program record and NVD detail page provide official information on the vulnerability. However, the exact scope of affected systems and potential impact on specific deployments is not detailed in the CVE record or NVD entry. Defenders should verify ShowDoc versions and assess exposure based on the information provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.