Executive brief
Scotty is a PHP SSH task runner tool. The self-updater functionality could download and execute malicious code if an attacker intercepts the download, because it only checked that the downloaded file was non-empty and met a minimum size—not that it was authentic. An attacker with network access to the download could inject malicious code that executes when Scotty updates itself.
Technical details
The vulnerability exists in the SelfUpdater::update function, which lacked cryptographic verification of downloaded PHAR files before installation (CWE-494). An attacker positioned to perform MITM or DNS poisoning could replace the legitimate PHAR with malicious code. The fix (v1.4.3) adds ed25519 signature verification against a public key embedded in the application, so the authenticity of releases is no longer transport-dependent.
Affected products
- Spatie Scotty up to 1.4.2
Timeline
- 2026-09-18: disclosed
- 2026-09-08: patched: Version 1.4.3 released with signature verification