https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 05:59:59 +0000 https://db.gcve.eu/vuln/ghsa-63hm-g96r-2m2q <p><strong>Affected:</strong> Packagist: laravel/framework</p> <p>### Summary</p> <p>If a concurrency task prints user-controlled text, an attacker can forge the framework&#39;s internal result message and achieve remote code execution in certain conditions</p> <p>### Pre-reqs</p> <p>Insecure code and insecure handling of user provided input (devs trust user-provided input) :</p> <p>1. App has a route that reaches Concurrency::run() (Not by default, it requires app code)</p> <p>2. The task writes user-controlled data to stdout (echo/print/`dd` of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child&#39;s stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)</p> <p>### Patches * 13.40.0 * 12.71.0</p> <p><strong>Affected:</strong> Packagist: laravel/framework</p> <p>### Summary</p> <p>If a concurrency task prints user-controlled text, an attacker can forge the framework&#39;s internal result message and achieve remote code execution in certain conditions</p> <p>### Pre-reqs</p> <p>Insecure code and insecure handling of user provided input (devs trust user-provided input) :</p> <p>1. App has a route that reaches Concurrency::run() (Not by default, it requires app code)</p> <p>2. The task writes user-controlled data to stdout (echo/print/`dd` of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child&#39;s stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)</p> <p>### Patches * 13.40.0 * 12.71.0</p> https://db.gcve.eu/vuln/ghsa-63hm-g96r-2m2q