The Scramble tool generates API documentation for Laravel projects. From version 0.13.2 up to but not including 0.13.22, if the public documentation endpoints are accessed and validation rules reference user‑controlled input, the data supplied in the request may be evaluated as PHP code during documentation generation. This means that an attacker can cause arbitrary PHP code to execute in the application context, a classic code execution flaw identified as CWE‑94. The impact is the loss of all application confidentiality, integrity, and availability for affected deployments.

The affected product is the Scramble library from dedoc, used to produce OpenAPI documentation for Laravel applications. All releases between 0.13.2 and 0.13.21, inclusive, are vulnerable. The vulnerability is triggered only when the documentation endpoints are exposed to the outside world; if the service is isolated, the threat is mitigated.

The CVSS score of 9.4 indicates a critical severity. Because EPSS data is not available, the statistical likelihood of exploitation is unknown, but the design flaw suggests a high exploitation probability. The vulnerability is not listed in the CISA KEV catalog, yet the remote code execution potential warrants immediate attention. An attacker would exploit the flaw by sending a crafted request to the public documentation endpoint, causing user input referenced in validation rules to be evaluated as PHP code. The absence of an official workaround means the only practical defense is to patch or mitigate the conditions that enable the exploit.