CVE-2026-65973

MediumCVSS 6.4/10Last modified Nov 12, 2026

Description

Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a proc_open() command string. This issue has been patched in version 1.0.0.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-659749.9ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a CVE-2026-659756.5Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not includi CVE-2026-659766.5Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChu CVE-2026-659796.7OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version CVE-2026-65984.3A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_CVE-2026-659807.9Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.CVE-2026-659817.1Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFR CVE-2026-659828.7nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 requ CVE-2026-659837.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/c CVE-2026-659847.5FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.j CVE-2026-659856.0FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler CVE-2026-659868.5CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerab