ShowDoc versions prior to 3.9.6 contain a code injection flaw in the Mock feature that allows an authenticated user to execute arbitrary shell commands. The vulnerability leverages the mockjs template engine, which evaluates user supplied data via eval. An attacker can upload a crafted template containing escaped parentheses; when that template is retrieved through the infoByKey endpoint the eval call is executed, causing the shell command to run. The flaw thus grants attackers the ability to execute commands with the privileges of the running ShowDoc process, which can be root in the default Docker image.

Both open source and Dockerized deployments of ShowDoc from version 2.8.14 up to, but excluding, 3.9.6 are affected. This includes any server that hosts the Mock endpoint and permits authenticated users to add or view mock templates. Earlier releases before 2.8.14 and releases 3.9.6 and later contain the fix.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. While the EPSS score is not available, the nature of the flaw and its presence in the public Docker image suggest that exploitation could occur without sophisticated prerequisites. The vulnerability is not listed in the CISA KEV catalog, but the ability to run arbitrary commands—even as root—makes it extremely dangerous for any environment that does not restrict access to the Mock API or monitors for suspicious template content.