CVE-2026-93533: Spatie Scotty RCE Vulnerability

CVE-2026-93533 Overview

CVE-2026-93533 is an OS command injection vulnerability in spatie Scotty versions up to 1.4.4. The flaw resides in the DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions within app/Commands/DoctorCommand.php. An attacker can manipulate the host argument to inject arbitrary operating system commands. The Doctor Command Handler passes unescaped @servers host values into shell contexts, enabling remote command execution when a user runs the doctor command against attacker-influenced configuration. A pull request addressing the issue is pending upstream acceptance.

Critical Impact

Remote attackers can execute arbitrary OS commands by supplying a crafted host string that gets interpolated into shell invocations by Scotty's doctor diagnostic routines.

Affected Products

• spatie Scotty versions up to and including 1.4.4
• app/Commands/DoctorCommand.php component
• Doctor Command Handler routines (checkSshConnectivity, checkRemoteTools)

Discovery Timeline

• 2026-09-18 - CVE-2026-93533 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93533

Vulnerability Analysis

The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. Scotty is a deployment-oriented tool that reads server definitions from an @servers configuration block. The DoctorCommand performs preflight diagnostics against those servers, invoking shell utilities such as ssh to verify connectivity and remote tool availability. The host field is concatenated into the resulting command line without shell escaping or allow-list validation.

When a malicious host value contains shell metacharacters — for example a semicolon, backticks, or $() substitution — the injected payload executes on the machine running the doctor command. This is a local-execution impact triggered by remotely supplied configuration data, which matches the network attack vector with user interaction described in the CVSS 4.0 vector.

Root Cause

The root cause is missing neutralization of untrusted input before it reaches an OS command interpreter. DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools construct shell commands by string interpolation of the host parameter rather than using parameterized process execution APIs or applying escapeshellarg().

Attack Vector

An attacker supplies or influences an @servers entry — for example through a pull request to a shared repository, a compromised configuration file, or documentation that instructs a developer to add a specific host. When the victim executes the Scotty doctor command, the crafted host string is expanded by the shell and the attacker's commands run under the developer's local privileges.

No verified proof-of-concept code is published. Refer to the GitHub Scotty Command Injection Analysis for the researcher's technical write-up and to GitHub Scotty Issue #20 for the upstream discussion.

Detection Methods for CVE-2026-93533

Indicators of Compromise

• Unexpected child processes spawned by php, artisan, or the scotty binary — particularly shells (sh, bash), network tools (curl, wget, nc), or interpreters (python, perl).
• Modifications to @servers blocks in Scotty configuration files containing shell metacharacters such as ;, |, &, backticks, or $().
• Outbound network connections from developer workstations shortly after running scotty doctor.

Detection Strategies

• Audit source repositories and deployment configurations for @servers host values containing non-hostname characters.
• Monitor process ancestry on developer and CI systems to flag shells spawned as children of PHP or Scotty processes.
• Review shell history and CI job logs for invocations of scotty doctor immediately preceding anomalous command execution.

Monitoring Recommendations

• Enable command-line argument logging on endpoints and CI runners to capture the full argv of processes spawned by the Scotty binary.
• Alert on developer workstations initiating outbound connections to unfamiliar destinations while deployment tooling is active.
• Correlate version-control commits that modify Scotty configuration with subsequent process-execution telemetry.

How to Mitigate CVE-2026-93533

Immediate Actions Required

• Restrict use of scotty doctor to trusted, reviewed configuration files until a patched release is available.
• Validate all @servers host entries against a strict hostname or IP allow-list before running any Scotty command.
• Treat pull requests that modify deployment configuration as security-sensitive and require secondary review.

Patch Information

At the time of publication, the fix is proposed in GitHub Scotty Pull Request #22 and awaits maintainer acceptance. Track the GitHub Scotty Repository for a released version above 1.4.4 that incorporates the fix. Additional tracking data is available at VulDB CVE-2026-93533.

Workarounds

• Apply the proposed patch from Pull Request #22 locally by escaping host values with escapeshellarg() before shell interpolation.
• Run Scotty inside an isolated container or sandbox with no outbound network access and no sensitive credentials mounted.
• Enforce configuration review policies that reject @servers host values containing shell metacharacters.

# Configuration example: validate host values before running scotty doctor
grep -REn "@servers\s*\(\[.*['\"](.*[;&|`\$].*)['\"]" ./ && \
  echo "Suspicious host string detected - aborting" && exit 1