Spatie Scotty EUVD-2026-83045

Exploitation requires the attacker to control the 'host' value in a Scotty @servers configuration directive that a victim subsequently processes by invoking the Doctor command (checkSshConnectivity or checkRemoteTools in app/Commands/DoctorCommand.php up to v1.4.4). The host string is passed unescaped into Process::fromShellCommandline, so shell metacharacters (e.g., ';', '${IFS}') in the host break out and run arbitrary local commands. Limiting factors: this is a local developer CLI tool, so the attacker must get malicious config in front of the victim and the victim must run the doctor command (user interaction), rather than exploiting a live network service; the 'remotely' claim in the description is not supported by the code path. Injected commands run only with the privileges of the user executing Scotty.

The only quantified exploitation signals available are the vendor CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, E:X). There is no EPSS score, no CISA KEV listing, and no confirmed public exploit in the provided data, so this is not a confirmed-active-exploitation priority. The CWE-78 OS command injection is real and is corroborated by the vendor's own fix (PR #22), which replaces shell-string interpolation (Process::fromShellCommandline with an untrusted host) with an argv array - strong evidence the vulnerability class is genuine. However, several signals conflict: the description asserts 'It is possible to initiate the attack remotely,' yet Scotty is a local Laravel-Zero CLI tool whose vulnerable 'host' argument originates from a parsed @servers configuration directive, which points to local/config-controlled input rather than a network-facing service - verify the true attack vector with the vendor before treating AV:N as accurate. The vendor also rated impact low (VC/VI/VA:L), but a command injection normally yields full command execution in the invoking user's context, so the real technical impact is arguably higher than the vendor's conservative scoring. Net: a legitimate but likely lower-urgency issue whose realistic exploitation requires an attacker to control the server config a victim then processes.

An attacker who can influence a Scotty @servers configuration entry (e.g., a shared, checked-in, or attacker-supplied config) sets a host value such as 'evil.example;touch${IFS}/tmp/pwned'. When a victim runs the 'doctor' command, checkSshConnectivity/checkRemoteTools interpolates that host into a shell command string, and the injected command executes locally under the victim's account. No public exploit code is identified, though the vendor's fix tests demonstrate the exact metacharacter payload style.