CVE-2026-93534
spatie Scotty Self Update SelfUpdater.php update code download
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 4b4e11bfc98e3a2159bb2b3d9b040293fcc44744. It is advisable to upgrade the affected component.
| CWE | CWE-494 |
| Vendor | spatie |
| Product | scotty |
| Published | Sep 18, 2026 |
| Last Updated | Sep 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for spatie scotty
Be the first to know when new medium vulnerabilities affecting spatie scotty are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
spatie / Scotty
1.4.0 1.4.1 1.4.2
References
vuldb.com: https://vuldb.com/vuln/407451 vuldb.com: https://vuldb.com/vuln/407451/cti vuldb.com: https://vuldb.com/cve/CVE-2026-93534 vuldb.com: https://vuldb.com/submit/943918 github.com: https://github.com/spatie/scotty/issues/21 github.com: https://github.com/spatie/scotty/commit/4b4e11bfc98e3a2159bb2b3d9b040293fcc44744 github.com: https://github.com/spatie/scotty/releases/tag/1.4.3 github.com: https://github.com/spatie/scotty/
Credits
🔍 summmm (VulDB User)