UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128083

Task Output Injection - Concurrency Process

Severity
Low 2.3
Published
4 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
12.71.0, 13.40.0
Weakness
Deserialization of untrusted data (CWE-502)
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Also known as
GHSA-63hm-g96r-2m2q
Sources
CVE Program, Project advisories (GitHub)

Description

If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions

Insecure code and insecure handling of user provided input (devs trust user-provided input) :

  • App has a route that reaches Concurrency::run() (Not by default, it requires app code)
  • The task writes user-controlled data to stdout (echo/print/dd of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)
From laravel/framework's security advisory.

Affected software

SoftwareAffected versions
LaravelServers and applications · cna:laravel|framework
  • Every version before 12.71.0
  • From 13.0.0 before 13.40.0
LaravelServers and applications · github:laravel/framework
  • Every version before 13.40.0

References