CVE-2026-93534

MediumCVSS 6.3

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

In the Self Update Handler component of spatie Scotty up to version 1.4.2, there is a vulnerability where code is downloaded without an integrity check. The SelfUpdater::update function allows remote exploitation.

Risk Assessment

An attacker could replace the downloaded code with malicious content, potentially leading to unauthorized code execution in the application environment.

Recommendation

Immediately upgrade the component to version 1.4.3, which contains the fix.

Other vulnerabilities in Spatie Scotty

CVE-2026-93533Medium
In the Doctor Command Handler component of spatie Scotty up to version 1.4.4, there is an OS command injection vulnerability via the host argument. The DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions allow remote attack.

Original NVD description (English source)

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 4b4e11bfc98e3a2159bb2b3d9b040293fcc44744. It is advisable to upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS