CVE-2026-44262
Published: 12 May 2026
Summary
CVE-2026-44262 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
Scramble, a package that generates API documentation for Laravel projects, is affected by a code injection vulnerability in versions 0.13.2 through 0.13.21. The flaw occurs when publicly accessible documentation endpoints process validation rules that reference user-controlled input, causing request data to be evaluated during documentation generation and resulting in arbitrary PHP code execution within the application context. The issue is tracked as CWE-94 and carries a CVSS 3.1 score of 9.4.
An unauthenticated remote attacker can exploit the vulnerability simply by submitting crafted requests to the exposed documentation endpoints, achieving code execution that compromises confidentiality and integrity with partial impact on availability.
The vulnerability is resolved in release 0.13.22, according to the project's GitHub advisory GHSA-4rm2-28vj-fj39 and corresponding tagged release. The EPSS score has remained flat at 0.0861 with no material increase observed since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29846
Vulnerability details
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code…
more
in the application context. This vulnerability is fixed in 0.13.22.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Publicly accessible documentation endpoints allow user-controlled input in validation rules to be evaluated, directly enabling remote arbitrary PHP code execution via exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces access control on the publicly exposed documentation endpoints so that unauthenticated requests cannot trigger evaluation of user-supplied validation rules.
Requires validation and sanitization of all input data before it is used in any evaluation or code-generation context, directly blocking the CWE-94 injection path.
Restricts the application to only the minimum required functionality, disabling or protecting the optional public documentation-generation feature that enables the vulnerability.