Vulnerability · Published May 12, 2026 · Assigned by GitHub_M
CVE-2026-44262Scramble: Remote code execution via evaluation of user-controlled input in validation rules
Critical 9.4
In plain English
A critical-severity code injection in scramble from dedoc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | dedoc/scramble | 0.13.22 | GHSA-4rm2-28vj-fj39 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
References
- https://github.com/dedoc/scramble/security/advisories/GHSA-4rm2-28vj-fj39 x_refsource_CONFIRM
- https://github.com/dedoc/scramble/releases/tag/v0.13.22 x_refsource_MISC