LARAVEL/FRAMEWORK · GHSA-63hm-g96r-2m2q · Package
FIX → >=v13.40.0
When a Laravel concurrency task prints user-controlled text to stdout, an attacker can forge the framework's internal result message. The advisory says this can lead to remote code execution under specific coding patterns.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that call Concurrency::run() from a route and have a task that writes user-controlled data to stdout. The advisory says this requires app code that handles input insecurely, so default setups are not exposed. Applications that do not use Concurrency::run() can skip it.
Not affected if default-config, no-concurrency-run
Who cares composer, laravel, php
composer show laravel/framework and compare the installed version with the fixed range.Concurrency::run( and check whether any task echoes, prints or dumps user input to stdout.Upgrade to >=v13.40.0
laravel/framework 13.40.0 and later in the 13.x lineIf a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions
Insecure code and insecure handling of user provided input (devs trust user-provided input) :
App has a route that reaches Concurrency::run() (Not by default, it requires app code)
The task writes user-controlled data to stdout (echo/print/dd of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.