CVE-2026-93533CWE-77CWE-78command-injection

CVE-2026-93533

Medium · published September 18, 2026

CVSS v3.1
6.3
EPSS
1%
Percentile
73.0
In the wild
Unconfirmed
What it is

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.01443 · 73.0th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-18T21:17Z
References (9)
https://github.com/spatie/scotty/ · [email protected]https://github.com/spatie/scotty/issues/20 · [email protected]https://github.com/spatie/scotty/pull/22 · [email protected]https://vuldb.com/cve/CVE-2026-93533 · [email protected]https://vuldb.com/submit/943917 · [email protected]https://vuldb.com/vuln/407450 · [email protected]https://vuldb.com/vuln/407450/cti · [email protected]https://github.com/spatie/scotty/issues/20 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/sumo166/CVE-apply/blob/main/spatie/scotty/Doctor%20Command%20Injection%20via%20Unescaped%20@servers%20Host%20(CWE-78)_cve.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 1%
    epss
  • 18 SEP 16:15Z
    spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection
    cvelistv5