CVE-2026-68489: Code Injection

Q: Which extension versions are affected?

Affected versions are Ruby earlier than 1.6.6 and Node.js Toolkit earlier than 2.5.0.

Q: What level of access does an attacker need?

An attacker must be remotely authenticated and able to use custom environment variables.

Q: What is the potential impact after exploitation?

Successful exploitation allows arbitrary code execution as root.

Published Sep 14, 2026

Updated

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

Affected Software

2 affected components

Plesk Plesk extensions "Ruby"<1.6.6

Plesk Plesk extensions "Node.js Toolkit"<2.5.0

Event History

Sep 14, 2026

CVE Published

via MITRE·08:53 PM

Data Sourced

via MITRE·08:53 PM

DescriptionWeakness

Frequently Asked Questions

Which extension versions are affected?

Affected versions are Ruby earlier than 1.6.6 and Node.js Toolkit earlier than 2.5.0.

What level of access does an attacker need?

An attacker must be remotely authenticated and able to use custom environment variables.

What is the potential impact after exploitation?

Successful exploitation allows arbitrary code execution as root.