OS Command Injection Vulnerability in Spatie Scotty by Spatie
CVE-2026-93533

5.3MEDIUM

Key Information:

Vendor

Spatie

Status
Scotty
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93533?

A vulnerability has been identified in Spatie Scotty versions up to 1.4.4 that affects the Doctor Command Handler. This issue specifically resides in the handling of the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools, where manipulation of the 'host' argument can lead to a remote OS command injection. This type of attack allows an unauthorized user to execute arbitrary commands on the target system. A pull request intended to remediate this vulnerability is currently pending acceptance.

Affected Version(s)

Scotty 1.4.0

Scotty 1.4.1

Scotty 1.4.2

References

https://vuldb.com/vuln/407450
vdb-entrytechnical-description
https://vuldb.com/vuln/407450/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-93533
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

summmm (VulDB User)
VulDB CNA Team
.