CVE-2026-93534— spatie Scotty Self Update SelfUpdater.php update code download

Quick assessment

Affected

spatie Scotty

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 spatie Scotty 1.4.2 及更早版本中发现了一个漏洞。受影响的是组件“自我更新处理程序”中文件里的函数。该函数的缺陷导致系统会在未进行完整性校验的情况下下载代码。攻击者可以远程发起攻击。升级到 1.4.3 版本可修复此问题。该修复对应的补丁标识为。建议升级受影响的组件以消除该安全风险。

CVSS 6.3 · Medium EPSS 0.21% · P12 Updated Sep 19, 2026

Possible ATT&CK Techniques 1 AI

T1041 · Exfiltration Over C2 Channel

Affected Version Matrix 4

Vendor	Product	Version Range	Status
spatie	Scotty	`1.4.0`	affected
		`1.4.1`	affected
		`1.4.2`	affected
		`1.4.3`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

spatie Scotty Self Update SelfUpdater.php update code download

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 4b4e11bfc98e3a2159bb2b3d9b040293fcc44744. It is advisable to upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

下载代码缺少完整性检查

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
spatie	Scotty	1.4.0	`cpe:2.3:a:spatie:scotty::::::::`

II. Public POCs for CVE-2026-93534

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93534

请登录查看更多情报信息。

Other References for CVE-2026-93534 (2)

https://www.cve.org/CVERecord?id=CVE-2026-93534

IV. Related Vulnerabilities

Same product: Scotty

CVE-2026-93533
spatie Scotty Doctor DoctorCommand.php checkRemoteTools os c

Same vendor: spatie

Same weakness: CWE-494