CVE-2026-44262
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
Description
### Impact A remote code execution (RCE) vulnerability affects versions `0.13.2` through `0.13.21`. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. ### Patches Fixed in version `0.13.22`. ### Workarounds If upgrading is not immediately possible: * Restrict access to documentation endpoints (`/docs/api`, `/docs/api.json`) * Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input) * Disable documentation endpoints in production environments if not required These measures significantly reduce or prevent exploitability.
How to fix CVE-2026-44262
To remediate CVE-2026-44262, upgrade the affected package to a fixed version below.
- —upgrade to 0.13.22 or later
Is CVE-2026-44262 being exploited?
Moderate — EPSS is 5.9%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- >= 0.13.2, < 0.13.22
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |