Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

dedoc/scramble

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.4PackagistPublished

    Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules

    CVE-2026-44262 · GHSA-4rm2-28vj-fj39

    Affected
    • Packagist dedoc/scramble >= 0.13.2, <= 0.13.21
    Fixed in
    0.13.22· Vendor fix available
    Issue
    Impact A remote code execution (RCE) vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. Patches Fixed in version 0.13.22. Workarounds If upgrading is not immediately possible: Restrict access to documentation endpoints (/docs/api, /docs/api.json) Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input) Disable documentation endpoints in production environments if not required These measures significantly reduce or prevent exploitability.

    Recommended action: Upgrade to 0.13.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →