What is the CVSS score of CVE-2026-44262?

CVE-2026-44262 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Scramble are affected by CVE-2026-44262?

Scramble API documentation generator versions 0.13.2 through 0.13.21 contain a critical remote code execution vulnerability (CVSS 9.4) affecting any organization with publicly accessible…. A patch is available.

Is there a public PoC exploit available for CVE-2026-44262?

Yes, a public proof-of-concept exploit is available for CVE-2026-44262. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-44262?

Within 24 hours: Identify all Scramble installations and document current versions; disable public access to documentation endpoints if upgrade cannot be completed immediately. Within 7 days: Upgrade all affected instances to Scramble version 0.13.22 or later per vendor advisory. Within 30 days: Audit access logs for suspicious documentation endpoint requests; review validation rule configurations to ensure user-supplied input is not directly processed in documentation generation.

Scramble CVE-2026-44262

CRITICAL

Code Injection (CWE-94)

2026-05-06 https://github.com/dedoc/scramble

GHSA-4rm2-28vj-fj39

PHP Code Injection RCE

9.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

May 06, 2026 - 20:31 vuln.today

Analysis Generated

May 06, 2026 - 20:31 vuln.today

CVE Published

May 06, 2026 - 19:54 nvd

CRITICAL 9.4

DescriptionGitHub Advisory

Impact

A remote code execution (RCE) vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.

Patches

Fixed in version 0.13.22.

Workarounds

If upgrading is not immediately possible:

Restrict access to documentation endpoints (/docs/api, /docs/api.json)
Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input)
Disable documentation endpoints in production environments if not required

These measures significantly reduce or prevent exploitability.

Articles & Coverage 1

POC CVE-2026-44262: Unauthenticated RCE in dedoc/scramble Laravel API Documentation Generator May 07, 2026

AnalysisAI

Remote code execution in Scramble API documentation generator versions 0.13.2 through 0.13.21 allows unauthenticated attackers to execute arbitrary PHP code when documentation endpoints are publicly accessible and validation rules reference user-controlled input. Fixed in version 0.13.22. The CVSS score of 9.4 (Critical) reflects the network-accessible, low-complexity attack requiring no authentication, though exploitation requires specific configuration where documentation endpoints remain enabled and validation rules incorporate request-supplied data. No active exploitation (CISA KEV) or public POC identified at time of analysis, but the GitHub security advisory provides full technical details enabling reproduction.

Technical ContextAI

Scramble is a PHP Composer package (pkg:composer/dedoc_scramble) that generates API documentation for Laravel applications. The vulnerability stems from CWE-94 (Improper Control of Generation of Code/Code Injection) during the documentation generation process. When Scramble evaluates validation rule expressions to produce API documentation schemas, it processes user-controlled input from HTTP requests without adequate sanitization. If validation rules reference variables derived from request parameters (common in dynamic validation scenarios), the documentation generator evaluates these expressions in the PHP runtime, creating a code injection vector. The issue exists in the rule expression evaluation logic, which was addressed in PR #1145 by adding support for $this in rule expressions and improving evaluation safety through sandboxing or input validation. This affects Laravel applications using Scramble with publicly accessible documentation endpoints at /docs/api and /docs/api.json.

RemediationAI

Upgrade to Scramble version 0.13.22 immediately, available at https://github.com/dedoc/scramble/releases/tag/v0.13.22. The fix implements improved rules evaluation safety and proper handling of $this references in validation expressions (PR #1145). If immediate upgrade is not feasible, apply compensating controls in order of effectiveness: (1) Disable documentation endpoints entirely in production by removing Scramble route registration or setting SCRAMBLE_ENABLED=false in environment configuration - this eliminates the attack surface but prevents API documentation access; (2) Restrict /docs/api and /docs/api.json endpoints to internal IP ranges or authenticated users via web server rules (nginx location blocks, Apache .htaccess) or Laravel middleware - maintains documentation availability for authorized users but adds authentication bypass risk if misconfigured; (3) Audit all validation rules to eliminate references to request-derived variables in rule expressions, replacing dynamic rules with static alternatives - labor-intensive and may break intended validation logic for complex APIs. The vendor advisory at https://github.com/dedoc/scramble/security/advisories/GHSA-4rm2-28vj-fj39 confirms version 0.13.22 as the definitive fix with no known bypasses.