CVE-2026-93533

MediumCVSS 6.3

Published: 18/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.11%

65th percentile - higher than 65% of all known CVEs

Summary

In the Doctor Command Handler component of spatie Scotty up to version 1.4.4, there is an OS command injection vulnerability via the host argument. The DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions allow remote attack.

Risk Assessment

A remote attacker could execute arbitrary system commands on the server, potentially leading to full system compromise.

Recommendation

Monitor the status of the proposed fix (pull request) and apply it as soon as it becomes available. Until then, restrict access to diagnostic functions.

Other vulnerabilities in Spatie Scotty

CVE-2026-93534Medium
In the Self Update Handler component of spatie Scotty up to version 1.4.2, there is a vulnerability where code is downloaded without an integrity check. The SelfUpdater::update function allows remote exploitation.

Original NVD description (English source)

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS