Executive brief
Scramble is a tool used to automatically generate API documentation for Laravel web applications. A security flaw allows attackers to execute malicious code on the server if the documentation pages are publicly accessible and use certain input validation rules. This could lead to a full takeover of the application, theft of sensitive data, or disruption of services.
Technical details
A remote code execution (RCE) vulnerability exists in Scramble versions 0.13.2 through 0.13.21 due to improper control of code generation (CWE-94). When the documentation generation process encounters validation rules that reference user-controlled input, it may evaluate that data as PHP code. An unauthenticated attacker can exploit this by sending crafted requests to publicly accessible documentation endpoints (such as /docs/api or /docs/api.json). This allows for arbitrary PHP code execution within the application's context. The issue is resolved in version 0.13.22 by improving the safety of rule expression evaluation.
Affected products
- dedoc Scramble >=0.13.2, <0.13.22
Timeline
- 2026-04-27: patched: Version 0.13.22 released
- 2026-04-28: advisory: GitHub Security Advisory GHSA-4rm2-28vj-fj39 published
- 2026-05-12: disclosed: CVE-2026-44262 published to NVD