Vulnerability · Published Sep 18, 2026 · Assigned by VulDB

CVE-2026-93533spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

Medium 6.3

In plain English

A medium-severity OS command injection in Scotty from spatie. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)1.4%top 26.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

Vendor	Product	Versions
spatie	Scotty	1.4.01.4.11.4.21.4.31.4.4

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References

VDB-407450 | spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection vdb-entry, technical-description
VDB-407450 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-93533 | CVE Analysis and Report third-party-advisory
Submit #943917 | spatie Scotty 1.4.2 OS Command Injection third-party-advisory
https://github.com/spatie/scotty/issues/20 issue-tracking
https://github.com/spatie/scotty/pull/22 issue-tracking, patch
https://github.com/spatie/scotty/ product
https://github.com/sumo166/CVE-apply/blob/main/spatie/scotty/Doctor%20Command%20Injection%20via%20Unescaped%20@servers%20Host%20(CWE-78)_cve.md exploit