CVE-2026-128083
LOW
INFO
Priority: 0.00
BB Relevance:
45/100
Published: 2026-11-13
Modified: 2026-11-13
First seen: 2026-11-13
Status: active
Attack Surface
Network
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
X
AT:
Present
VC:
Low
VI:
Low
VA:
Low
Description
Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled bytes at the start of the child's standard output that form a complete JSON document followed by gzip magic bytes. Under those application-specific conditions, an attacker can forge the internal result message and achieve remote code execution. The affected behavior is not exposed by default and requires application code that routes untrusted input into task output. This issue is fixed in versions 12.71.0 and 13.40.0.
Weakness Classification (1)
Affected Software (2)
References & Advisories (6)
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM