Scramble: Remote code execution via evaluation of user-controlled input in validation rules
Title source: cnaExploitation Summary
EIP tracks 3 public exploits for CVE-2026-44262. PoCs published by joshua, dwisiswant0, joshuavanderpoll. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional exploit for CVE-2026-44262, targeting a remote code execution vulnerability in dedoc/scramble versions >=0.13.2 and <0.13.22. The exploit leverages an eval() injection in NodeRulesEvaluator::doEvaluateExpression() via a crafted query parameter on /docs/api.json.
Description
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
Exploits (3)
This is a functional exploit for CVE-2026-44262, targeting a remote code execution vulnerability in dedoc/scramble versions >=0.13.2 and <0.13.22. The exploit leverages an eval() injection in NodeRulesEvaluator::doEvaluateExpression() via a crafted query parameter on /docs/api.json.
This repository contains a functional exploit for CVE-2026-44262, demonstrating remote code execution via eval injection in the dedoc/scramble Laravel package. The exploit leverages variable name collision in the NodeRulesEvaluator to inject arbitrary PHP code.
This repository contains a functional exploit for CVE-2026-44262, targeting an unauthenticated RCE vulnerability in dedoc/scramble via a PHP code injection flaw in the NodeRulesEvaluator::doEvaluateExpression() function. The exploit leverages a query parameter on /docs/api.json to overwrite internal variables and execute arbitrary PHP code.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L