CVE-2026-44262: Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
Impact A remote code execution (RCE) vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. Patches Fixed in version 0.13.22.
Published May 6, 2026 · Updated May 13, 2026
Affected packages
dedoc/scramble
- Ecosystem
- Composer (PHP)
- Affected
- >= 0.13.2, <= 0.13.21
- Fixed in
- 0.13.22
- Check
composer show dedoc/scramble
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
A remote code execution (RCE) vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.
Patches
Fixed in version 0.13.22.
Workarounds
If upgrading is not immediately possible:
- Restrict access to documentation endpoints (
/docs/api,/docs/api.json) - Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input)
- Disable documentation endpoints in production environments if not required
These measures significantly reduce or prevent exploitability.
Credited to FORIMOC.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology