CVE-2026-65973

CVSS 6.4 (medium) · published 2026-11-11

Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a proc_open() command string. This issue has been patched in version 1.0.0.

Weakness: CWE-78

Source: NVD CVE-2026-65973

References

• https://github.com/PeteBishwhip/laradocs/releases/tag/v1.0.0
• https://github.com/PeteBishwhip/laradocs/security/advisories/GHSA-h746-qpxh-ph7g

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.