CVE-2026-93533

Name of the Vulnerable Software and Affected Versions spatie Scotty versions prior to 1.4.5

Description OS command injection is possible via remote attack in the Doctor Command Handler component. The issue exists within the DoctorCommand::checkSshConnectivity() and DoctorCommand::checkRemoteTools() functions located in the app/Commands/DoctorCommand.php file, where improper handling of the host argument allows for the execution of arbitrary operating system commands.

Recommendations As a temporary workaround, restrict access to the DoctorCommand::checkSshConnectivity() and DoctorCommand::checkRemoteTools() functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.