Scramble CVE-2026-44262
CRITICAL
GHSA-4rm2-28vj-fj39
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionNVD
Impact
A remote code execution (RCE) vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.
Patches
Fixed in version 0.13.22.
Workarounds
If upgrading is not immediately possible:
- Restrict access to documentation endpoints (
/docs/api,/docs/api.json) - Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input)
- Disable documentation endpoints in production environments if not required
These measures significantly reduce or prevent exploitability.
AnalysisAI
Remote code execution in Scramble API documentation generator versions 0.13.2 through 0.13.21 allows unauthenticated attackers to execute arbitrary PHP code when documentation endpoints are publicly accessible and validation rules reference user-controlled input. Fixed in version 0.13.22. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Scramble installations and document current versions; disable public access to documentation endpoints if upgrade cannot be completed immediately. Within 7 days: Upgrade all affected instances to Scramble version 0.13.22 or later per vendor advisory. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today