CVE-2026-44262CWE-94

Scramble: Remote code execution via evaluation of user-controlled input in validation rules

Critical · published May 12, 2026

CVSS v3.1
9.4
EPSS
4%
Percentile
90.2
In the wild
Unconfirmed
What it is

Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.03872 · 90.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-12T20:56Z
EPSS history
Timeline
  • 12 MAY 20:56Z
    Scramble: Remote code execution via evaluation of user-controlled input in validation rules
    cvelistv5