The Scramble API documentation generator for Laravel applications contains a critical remote code execution vulnerability. Tracked as CVE-2026-44262, the bug affects versions from 0.13.2 up to (but not including) 0.13.22.
The root cause lives in Scramble’s PHP expression evaluator — specifically the NodeRulesEvaluator::doEvaluateExpression() method. It uses PHP’s extract() function combined with eval() in a way that lets an attacker overwrite internal variables. By sending a crafted query parameter to the /docs/api.json endpoint, a remote attacker can inject arbitrary PHP code that gets executed on the server.
The endpoint that’s vulnerable — /docs/api.json — is often left exposed in production because it powers the API docs UI. The exploit doesn’t require authentication. If your Scramble docs are publicly accessible, this is exploitable right now.
The vendor released version 0.13.22 with a fix. Update immediately. As a temporary mitigation, restrict access to the /docs/api.json endpoint at the web server level, or take the docs offline until you can patch.
