Description
Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a proc_open() command string. This issue has been patched in version 1.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PeteBishwhip | laradocs | >= 0.4.0, < 1.0.0 | — |