Scotty
Monthly
Missing integrity verification in spatie Scotty's self-update handler (SelfUpdater::update in app/Updater/SelfUpdater.php) allows a tampered release artifact to be downloaded and installed as the running application in versions up to and including 1.4.2. Because the updater fetches the phar without validating a signature or hash, an attacker who can substitute the distributed artifact - for example through a compromised GitHub release or maintainer credential, a malicious mirror, or interception of the download - gains execution of arbitrary PHP within the Scotty process once an operator triggers the self-update; CVSS 4.0 lists PR:N (unauthenticated) with UI:P, so user interaction is required but no prior authentication is. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-supplied CVSS 4.0 base score is 5.3, while our independent assessment rates it higher under CVSS 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) because of the high integrity and confidentiality impact of replacing the application binary.
OS command injection in the Spatie Scotty developer CLI (through v1.4.4) lets a malicious 'host' value in a Scotty @servers configuration directive break out of the local shell and execute arbitrary commands when a victim runs the Doctor command. Because the host string is interpolated unescaped into Process::fromShellCommandline, shell metacharacters such as ';' and '${IFS}' in a crafted host are interpreted by the local shell rather than passed literally to ssh. This is a local CLI tool, so exploitation requires the attacker to get malicious configuration in front of the victim and the victim to subsequently invoke Doctor (checkSshConnectivity or checkRemoteTools), and any injected commands run only with the victim's own user privileges; no public exploit code has been identified at time of analysis, and vendor CVSS 4.0 rates this 5.3 with current exploit maturity unproven (E:X).
Missing integrity verification in spatie Scotty's self-update handler (SelfUpdater::update in app/Updater/SelfUpdater.php) allows a tampered release artifact to be downloaded and installed as the running application in versions up to and including 1.4.2. Because the updater fetches the phar without validating a signature or hash, an attacker who can substitute the distributed artifact - for example through a compromised GitHub release or maintainer credential, a malicious mirror, or interception of the download - gains execution of arbitrary PHP within the Scotty process once an operator triggers the self-update; CVSS 4.0 lists PR:N (unauthenticated) with UI:P, so user interaction is required but no prior authentication is. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-supplied CVSS 4.0 base score is 5.3, while our independent assessment rates it higher under CVSS 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) because of the high integrity and confidentiality impact of replacing the application binary.
OS command injection in the Spatie Scotty developer CLI (through v1.4.4) lets a malicious 'host' value in a Scotty @servers configuration directive break out of the local shell and execute arbitrary commands when a victim runs the Doctor command. Because the host string is interpolated unescaped into Process::fromShellCommandline, shell metacharacters such as ';' and '${IFS}' in a crafted host are interpreted by the local shell rather than passed literally to ssh. This is a local CLI tool, so exploitation requires the attacker to get malicious configuration in front of the victim and the victim to subsequently invoke Doctor (checkSshConnectivity or checkRemoteTools), and any injected commands run only with the victim's own user privileges; no public exploit code has been identified at time of analysis, and vendor CVSS 4.0 rates this 5.3 with current exploit maturity unproven (E:X).