Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
Impact
A remote code execution (RCE) vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.
Patches
Fixed in version 0.13.22.
Workarounds
If upgrading is not immediately possible:
- Restrict access to documentation endpoints (
/docs/api,/docs/api.json) - Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input)
- Disable documentation endpoints in production environments if not required
These measures significantly reduce or prevent exploitability.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | dedoc/scramble | >= 0.13.2, < 0.13.22 | 0.13.22 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L- Weakness (CWE)
CWE-94- Platform
- Composer
- Package
dedoc/scramble- Disclosed
- 06.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4rm2-28vj-fj39 - CC BY 4.0
Vulnerability history: dedoc/scramble
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.