CVE-2026-68489

Vulnerability Description

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

Related Weaknesses (CWE)

CWE-96

References

https://support.plesk.com/hc/en-us/articles/43473204617239

FAQ

What is CVE-2026-68489?

CVE-2026-68489 is a documented vulnerability. Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

How severe is CVE-2026-68489?

CVSS scoring is not yet available for CVE-2026-68489. Check NVD for updates.

Is there a patch for CVE-2026-68489?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.