The vulnerability in Laradock’s Build Process allows an attacker to remotely trigger the download of arbitrary code into the workspace Dockerfile without an integrity check, as the affected function in workspace/Dockerfile can be manipulated. This exposes the system to execution of malicious payloads.

The vulnerability affects the Laradock project and its Dockerfiles, specifically versions up to 20.4.; any deployment using those builds is at risk.

With a CVSS score of 2.3 the severity remains low, but the EPSS score of less than 1% indicates a very low likelihood that this vulnerability will be exploited in the wild. The exploit is publicly available and can be launched remotely, yet the high complexity and difficulty reduce its real-world risk. The lack of integrity checks still raises the concern that arbitrary code could be downloaded and executed during the build process, however the overall risk is mitigated by the low EPSS. The vulnerability is not listed in CISA’s KEV catalog.