HIGH 8.7 NVD

CVE-2026-68489

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

References

https://support.plesk.com/hc/en-us/articles/43473204617239

Published: 2026-09-14 · Source: NVD · Feed updated: 2026-09-15

This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-14 via NVD.

vulnfeed aggregates 10822 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.