Executive brief
Spatie Scotty is a PHP SSH task runner used by developers to manage remote server deployments. A vulnerability in its doctor command allows attackers who can provide a malicious configuration file to execute arbitrary commands on the developer's machine. An attacker could gain code execution on the developer's system by tricking them into running the doctor command with a crafted Scotty configuration.
Technical details
The DoctorCommand::checkSshConnectivity() and DoctorCommand::checkRemoteTools() methods directly interpolate unsanitized host values from the @servers configuration directive into shell command strings and execute them via Process::fromShellCommandline(), allowing OS command injection via shell metacharacters. The vulnerability requires the victim to run scotty doctor against an attacker-influenced configuration file (e.g., from a malicious repository or via --conf/--path argument pointing to attacker-controlled content). A fix is pending in a pull request awaiting acceptance.
Affected products
- Spatie Scotty up to 1.4.4
Timeline
- 2026-09-18: disclosed: Vulnerability published to NVD