CVE-2026-65973: Laradocs: Command injection via unescaped Node.js binary path in KaTeX SSR

Published Nov 11, 2026

Updated

Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a procopen() command string. This issue has been patched in version 1.0.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Laradocs to a version that resolves this vulnerability.
Fixed in 1.0.0

Event History

Nov 11, 2026

CVE Published

via MITRE·09:02 PM

Data Sourced

via MITRE·09:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Laradocs versions 0.4.0 through versions before 1.0.0 are affected. Version 1.0.0 contains the patch.

What access does an attacker need to exploit this issue?

Exploitation is local and requires high privileges. The vulnerable path is the Node.js binary path used by server-side KaTeX rendering.

What is the recommended remediation?

Upgrade Laradocs to version 1.0.0. If upgrading is not immediately possible, restrict who can modify or control the Node.js binary path used for KaTeX SSR.