CVE-2026-44262 Scramble: Remote code execution via evaluation of user-controlled input in validation rules
Attackers can execute arbitrary PHP code if documentation endpoints are public and validation rules process user input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44262?
CVE-2026-44262 is a critical code injection vulnerability in dedoc scramble, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
Weakness: CWE-94
Which versions are affected by CVE-2026-44262?
2 open source packages ship an affected version, including dedoc/scramble.
| Package | Affected | Fixed in |
|---|---|---|
dedoc/scramble Packagist | From 0.13.2 | 0.13.22 |
dedoc/scramble Packagist | From 0.13.2 | 0.13.22 |
How do I fix CVE-2026-44262?
Upgrade dedoc/scramble to 0.13.22 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44262 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.
Sources
Also known as GHSA-4rm2-28vj-fj39.