| शीर्षक | spatie Scotty 1.4.2 OS Command Injection |
|---|
| विवरण | Scotty (spatie/scotty) version 1.4.2 is vulnerable to OS command injection in the `doctor` command. `DoctorCommand::checkSshConnectivity()` and `DoctorCommand::checkRemoteTools()` interpolate the server host defined by the `@servers` directive into shell command strings (`ssh -o ConnectTimeout=5 -o BatchMode=yes {host} '...'`) without sanitization or shell escaping, and execute them via `Process::fromShellCommandline()`. An attacker who can supply a crafted Scotty file (for example, via a malicious repository, or by pointing `--conf`/`--path` at an attacker-influenced file) can inject shell metacharacters into the host value (e.g. `evil.example;touch${IFS}/tmp/pwned`), causing arbitrary commands to execute on the developer's machine when the victim runs `scotty doctor`, leading to local code execution.
Reproduction: https://github.com/sumo166/CVE-apply/blob/main/spatie/scotty/Doctor%20Command%20Injection%20via%20Unescaped%20@servers%20Host%20(CWE-78)_cve.md |
|---|
| स्रोत | ⚠️ https://github.com/spatie/scotty/issues/20 |
|---|
| उपयोगकर्ता | summmm (UID 69690) |
|---|
| सबमिशन | 23/08/2026 07:47 AM (27 दिन पहले) |
|---|
| संयम | 18/09/2026 10:54 AM (26 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407450 [spatie Scotty तक 1.4.4 Doctor Command DoctorCommand.php checkRemoteTools host अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|