Read the docs
TI-2026-63015 Aliases CVE-2026-93533GHSA-q246-734p-8872

spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

Priority MEDIUM 57CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01443 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
spatieScotty1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4—No fix listedCNA
  • Scotty Vendorspatie Affected 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:spatie:scotty:*:*:*:*:*:*:*:*——spatie
  • cpe:2.3:a:spatie:scotty:*:*:*:*:*:*:*:* Versions — — ·spatie

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93533
  2. 2026-10-03 Alias added: GHSA-q246-734p-8872

References

Patch 1

Other 2

  • TI-2022-21618 Browsershot 3.57.3 - Server Side XSS to LFR via HTML CVSS 3.1HIGH 8.2
  • TI-2022-21617 Browsershot 3.57.2 - Server Side XSS to LFR via HTML CVSS 3.1HIGH 8.2
  • TI-2022-20098 Browsershot 3.57.2 - Server Side XSS to LFR via URL CVSS 3.1HIGH 8.2
  • TI-2026-63016 spatie Scotty Self Update SelfUpdater.php update code download CVSS 4.0MEDIUM 5.3
  • TI-2021-20389 The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel… CVSS 3.1CRITICAL 9.8
  • TI-2026-35915 Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php CVSS 4.0HIGH 8.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences