CVE-2026-93534: Spatie Scotty RCE Vulnerability

CVE-2026-93534 Overview

CVE-2026-93534 is an integrity vulnerability in spatie Scotty versions up to 1.4.2. The flaw resides in the SelfUpdater::update function within app/Updater/SelfUpdater.php, part of the Self Update Handler component. The updater downloads code without verifying its integrity, allowing an attacker positioned to influence the download to deliver tampered content. Exploitation requires user interaction to initiate the update. The issue is classified under CWE-494: Download of Code Without Integrity Check. Upgrading to version 1.4.3 resolves the vulnerability.

Critical Impact
A remote attacker able to tamper with update artifacts can deliver malicious code through Scotty's self-update mechanism, compromising the confidentiality, integrity, and availability of the host running Scotty.

Affected Products

spatie Scotty versions up to and including 1.4.2
Component: Self Update Handler (app/Updater/SelfUpdater.php)
Fixed in: spatie Scotty 1.4.3

Discovery Timeline

2026-09-18 - CVE-2026-93534 published to NVD
2026-09-18 - Last updated in NVD database
Patch commit - 4b4e11bfc98e3a2159bb2b3d9b040293fcc44744 merged in the spatie/scotty repository
Release - Fixed version published as Scotty v1.4.3

Technical Details for CVE-2026-93534

Vulnerability Analysis

Scotty is a PHP-based command-line tool distributed as a phar archive. The SelfUpdater::update routine retrieves a new phar from a remote source and replaces the running binary. Prior to 1.4.3, no signature check validated the downloaded phar before it was installed and executed. This allows any attacker able to modify the update payload in transit or at the delivery endpoint to substitute an arbitrary phar that will run under the privileges of the user invoking the update.

The fix introduces an ed25519 signature verification workflow. A release signing keypair is generated with libsodium, the secret key is stored as the SCOTTY_RELEASE_SIGNING_KEY repository secret, and the public key is embedded in App\Updater\ReleaseSigningKey::PUBLIC_KEY. Each release phar is signed by .github/scripts/sign-phar.php, and the client verifies the detached signature via SignatureVerifier before replacing the local binary.

Root Cause

The root cause is missing cryptographic verification of downloaded update artifacts. The self-updater trusted the remote source implicitly and applied the downloaded phar without validating its origin or contents against a known public key.

Attack Vector

Exploitation is remote and requires user interaction, since the victim must invoke the self-update command. An attacker capable of tampering with the update channel, for example through DNS hijacking, a compromised release endpoint, or a man-in-the-middle position, can deliver a malicious phar that Scotty will install and execute.

php

<?php

/**
 * Generates the ed25519 keypair that Scotty releases are signed with.
 *
 * Run it once, on a trusted machine:
 *
 *     php .github/scripts/generate-signing-key.php
 *
 * Store the secret key in the `SCOTTY_RELEASE_SIGNING_KEY` repository secret and commit the public
 * key in `App\Updater\ReleaseSigningKey::PUBLIC_KEY`. Never commit the secret key.
 */
if (! function_exists('sodium_crypto_sign_keypair')) {
    fwrite(STDERR, "The PHP sodium extension is required to generate a signing key.\n");

    exit(1);
}

$keypair = sodium_crypto_sign_keypair();

$secretKey = base64_encode(sodium_crypto_sign_secretkey($keypair));
$publicKey = base64_encode(sodium_crypto_sign_publickey($keypair));

echo "Secret key (store in the SCOTTY_RELEASE_SIGNING_KEY repository secret):\n{$secretKey}\n\n";
echo "Public key (paste into App\\Updater\\ReleaseSigningKey::PUBLIC_KEY):\n{$publicKey}\n";

Source: GitHub Commit 4b4e11b — this patch introduces the ed25519 signing key generation script that underpins the new verification workflow.

Detection Methods for CVE-2026-93534

Indicators of Compromise

Unexpected modifications to the Scotty phar binary on disk, particularly changes to file hash or size following a self-update.
Outbound network connections from Scotty to hosts other than the official spatie/scotty release endpoint.
Child processes spawned by Scotty that do not match documented CLI behavior after an update event.

Detection Strategies

Baseline the SHA-256 hash of installed Scotty phar files and alert on drift that does not match a signed release hash from the vendor.
Inspect process telemetry for invocations of Scotty's self-update command followed by anomalous file writes to the binary path.
Monitor for PHP processes executing phar archives from writable user directories immediately after network downloads.

Monitoring Recommendations

Collect endpoint file-integrity events for developer and CI hosts where Scotty is installed.
Log DNS and HTTPS destinations for update traffic and compare against the vendor's known distribution domains.
Correlate self-update command execution with subsequent process activity to identify tampered payloads.

How to Mitigate CVE-2026-93534

Immediate Actions Required

Upgrade all installations of spatie Scotty to version 1.4.3 or later, which enforces signature verification.
Audit hosts that previously ran scotty self-update on versions <= 1.4.2 for unexpected phar modifications or unknown child processes.
Restrict self-update execution to trusted networks until the upgrade is applied.

Patch Information

The fix is delivered in commit 4b4e11bfc98e3a2159bb2b3d9b040293fcc44744 and shipped as spatie Scotty v1.4.3. The patch adds App\Updater\SignatureVerifier and App\Updater\ReleaseSigningKey, and modifies SelfUpdater::update to verify a detached ed25519 signature of the downloaded phar before replacing the local binary. See the upstream issue and the VulDB entry for CVE-2026-93534 for additional detail.

Workarounds

Disable use of scotty self-update and instead download release phars manually from the vendor's GitHub releases page, verifying published hashes.
Pin Scotty to a known-good version installed via a controlled package or artifact pipeline rather than in-band updates.
Enforce HTTPS certificate pinning or an outbound proxy allowlist for hosts that must fetch Scotty updates.

bash

# Upgrade Scotty to the patched release
composer global require spatie/scotty:^1.4.3

# Or replace the phar manually and verify its SHA-256 against the vendor release
curl -L -o scotty.phar https://github.com/spatie/scotty/releases/download/1.4.3/scotty
sha256sum scotty.phar