Advisories · Technology

WebPros Plesk extension "Node.js Toolkit".

Every CVE that names WebPros Plesk extension "Node.js Toolkit" among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-68489 CVE record

CVSS 8.7 High

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
- WebPros Plesk extension "Ruby"
- WebPros Plesk extension "Node.js Toolkit"
- Code injection
Not analysed yet 14 Sept 2026