CVE Intelligence
Analysis AI-assisted

CVE-2026-44262: Dedoc Scramble: remote code execution via evaluation of user-controlled input in validation rules

CVE-2026-44262 affects Dedoc Scramble, a tool that generates API documentation for Laravel projects, in versions from 0.13.2 before 0.13.22. When documentation endpoints are publicly reachable and validation rules reference user-supplied input, that input may be evaluated during documentation generation, which can lead to execution of arbitrary PHP code. The sources state the flaw is fixed in 0.13.22, and no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Scramble generates API documentation for Laravel projects. This record describes a code injection flaw (CWE-94) in versions from 0.13.2 before 0.13.22. The issue arises when documentation endpoints are publicly accessible and validation rules reference user-controlled input, because request-supplied data may be evaluated during documentation generation.

Impact

  • The description states that the flaw can lead to execution of arbitrary PHP code in the application context.
  • The recorded CVSS 3.1 base score is 9.4 (critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, meaning network reachability, low complexity, no privileges and no user interaction are required.
  • The SSVC data in the record marks the issue as automatable and as having total technical impact.

Affected products and versions

  • Product: Dedoc Scramble.
  • Affected range: from 0.13.2 up to, but not including, 0.13.22.
  • The description states the vulnerability is fixed in 0.13.22. The record's fixes list is empty, so the fix is taken from the description and the release reference.

Exploitation status

CISA KEV does not list this CVE. The sources consulted do not confirm active exploitation or public exploit availability. SSVC exploitation is recorded as none. The EPSS probability in the record is 0.03872 with a percentile of 0.89983.

Remediation and mitigation

  • Upgrade Scramble to version 0.13.22, which the sources identify as the fixed release. See the GitHub release.
  • Review the GitHub Security Advisory for vendor guidance.
  • Until patching is complete, do not expose API documentation endpoints publicly in production environments.
  • Review validation rules that depend on request input and remove dynamic constructs where they are not needed.

Detection guidance

  • Review web server and application logs for unusual requests to API documentation routes, especially from unknown sources.
  • Inventory Laravel projects that use Scramble and record the installed version, flagging anything below 0.13.22.
  • Look for unexpected errors or behavior during documentation generation, which may indicate attempted abuse.

Limitations of the available information

  • The record's source status is Deferred, and the fixes list is empty.
  • The sources do not describe the exact validation rule patterns that trigger the flaw.
  • No exploitation evidence or indicators of compromise were available in the record.
  • Whether later versions beyond 0.13.22 are also fixed is not stated in the record.

Frequently asked questions

Which Scramble versions are affected by CVE-2026-44262?

The record lists versions from 0.13.2 up to, but not including, 0.13.22. The description states the fix is in 0.13.22.

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none.

What is the main mitigation?

Upgrade Scramble to 0.13.22 or a later release, and avoid exposing API documentation endpoints publicly while the update is pending.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.