Spatie Scotty CVE-2026-93534

Requires that the attacker can tamper with the phar delivered to SelfUpdater::update - e.g. compromise of the GitHub release asset/maintainer token, a malicious mirror, or an on-path MITM of the download (the pre-1.4.3 code performs no signature or hash verification). It also requires user interaction (UI:P): an operator must actively invoke Scotty's self-update. Affected versions are Scotty up to and including 1.4.2 (cpe:2.3:a:spatie:scotty); the fix in 1.4.3 adds ed25519 signature verification, so patched installations that ship the signing key are not exploitable. Limiting factors: the delivery channel is normally GitHub over HTTPS, so plain MITM is impractical without breaking TLS, and exploitation is contingent on a maintainer/release-channel compromise plus a user-triggered update.

This is a supply-chain/self-update integrity flaw (CWE-494) in spatie Scotty's SelfUpdater. The vendor CVSS 4.0 base score is 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L), treating each impact as Low - but this is arguably conservative: successful substitution of the downloaded phar yields arbitrary code execution when the tool next runs, which is a full integrity/availability/confidentiality compromise of the host running Scotty. The countervailing factor is that exploitation is NOT low-complexity in practice: the attacker must be able to tamper with the download (compromise the GitHub release/maintainer account, or achieve an on-path MITM), so I assess AC:H rather than the vendor's AC:L. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC in the references (VulDB advisory and GitHub issue/commit only). The E:X (Exploit Maturity: Not Defined) in the vector confirms exploitation maturity is unspecified. Net: a legitimate integrity/supply-chain weakness worth patching, but not an emergency - it requires a privileged position in the delivery channel plus a user running the self-update, so it is a moderate, targeted-risk issue rather than a mass-exploitable one. Note the CVSS is a 4.0 vector (no 3.1 provided), and the 'Information Disclosure' tag conflicts with the actual weakness class (code integrity / potential code execution).

An attacker who compromises the release channel (GitHub release asset, maintainer token) or achieves an on-path position replaces the Scotty phar served to SelfUpdater::update with a malicious build. When an operator runs the self-update command, the unsigned phar is downloaded and installed without verification, and the attacker's code executes with the privileges of the user running Scotty. No public exploit code is currently identified.