Technical impact
The Scramble tool generates API documentation for Laravel projects. From version 0.13.2 up to and including 0.13.21, if the public documentation endpoints are accessed and validation rules reference user‑controlled input, the data supplied in the request may be evaluated as PHP code during documentation generation. This means that an attacker can cause arbitrary PHP code to execute in the application context, a classic code execution flaw identified as CWE‑94. The impact is the loss of all application confidentiality, integrity, and availability for affected deployments.
Affected Systems
The affected product is the Scramble library from dedoc, used to produce OpenAPI documentation for Laravel applications. All releases between 0.13.2 and 0.13.21, inclusive, are vulnerable. The vulnerability is triggered only when the documentation endpoints are exposed to the outside world; it is inferred that isolating the service would mitigate this threat.
Risk and Exploitability
The CVSS score of 9.4 indicates a critical severity. The EPSS score of 6% indicates a low to moderate probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet the remote code execution potential warrants immediate attention. Based on the description, it is inferred that the attack vector is the public documentation endpoint accessed over HTTP or HTTPS, where an attacker can send a crafted request causing user input referenced in validation rules to be evaluated as PHP code. The absence of an official workaround means the only practical defense is to patch or mitigate the conditions that enable the exploit.
Github GHSA