CVE-2026-93533 Details
Description
A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.
A command injection vulnerability has been identified in Spatie Scotty versions through 1.4.4. The issue arises in the Doctor Command Handler, specifically within the checkSshConnectivity and checkRemoteTools functions of the app/Commands/DoctorCommand.php file. The vulnerability allows for OS command injection by manipulating the host argument, which is then executed via an SSH command without proper sanitization. This issue can be exploited remotely.
A pull request to fix this vulnerability has been submitted and is awaiting acceptance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/spatie/scotty/issues/20 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sumo166/CVE-apply/blob/main/spatie/scotty/Doctor%20Command%20Injection%20via%20Unescaped%20@servers%20Host%20(CWE-78)_cve.md | CISA-ADP | |
| https://github.com/spatie/scotty/ | [email protected] | ProductVendor |
| https://github.com/spatie/scotty/issues/20 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/spatie/scotty/pull/22 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-93533 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/943917 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/407450 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/407450/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| spatie Scotty | <= 1.4.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |