CVE-2026-93534CWE-494

CVE-2026-93534

Medium · published September 18, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 4b4e11bfc98e3a2159bb2b3d9b040293fcc44744. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00213 · 11.0th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2026-09-18T21:17Z
References (9)
https://github.com/spatie/scotty/ · [email protected]https://github.com/spatie/scotty/commit/4b4e11bfc98e3a2159bb2b3d9b040293fcc44744 · [email protected]https://github.com/spatie/scotty/issues/21 · [email protected]https://github.com/spatie/scotty/releases/tag/1.4.3 · [email protected]https://vuldb.com/cve/CVE-2026-93534 · [email protected]https://vuldb.com/submit/943918 · [email protected]https://vuldb.com/vuln/407451 · [email protected]https://vuldb.com/vuln/407451/cti · [email protected]https://github.com/spatie/scotty/issues/21 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 16:30Z
    spatie Scotty Self Update SelfUpdater.php update code download
    cvelistv5