{"id":"GHSA-63hm-g96r-2m2q","kind":"vulnerability","aliases":["GHSA-63hm-g96r-2m2q"],"related":[],"title":"Task Output Injection - Concurrency Process","description":"### Summary\r\n\r\nIf a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions\r\n\r\n### Pre-reqs\r\n\r\nInsecure code and insecure handling of user provided input (devs trust user-provided input) :\r\n\r\n1. App has a route that reaches Concurrency::run() (Not by default, it requires app code)\r\n\r\n2. The task writes user-controlled data to stdout (echo/print/`dd` of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \\x1f\\x8b  (Not by default, requires the specific coding pattern in the app code)\r\n\r\n### Patches\r\n* 13.40.0\r\n* back-ported to 12.x as well","summary":"When a Laravel concurrency task prints user-controlled text to stdout, an attacker can forge the framework's internal result message. The advisory says this can lead to remote code execution under specific coding patterns.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"laravel/framework","note":"<v13.40.0","fixed":[">=v13.40.0"],"affected":"< v13.40.0","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["composer","laravel","package","php"],"not_affected_if":["default-config","no-concurrency-run"],"how_to_check":"- Run `composer show laravel/framework` and compare the installed version with the fixed range.\n- Search the app for `Concurrency::run(` and check whether any task echoes, prints or dumps user input to stdout.","fix":"- `laravel/framework` `13.40.0` and later in the 13.x line\n- Back-ported to the 12.x line; the exact 12.x fixed version is unknown from the sources","status":"open","published_at":"2026-11-04T09:13:11+00:00","first_seen_at":"2026-11-09T22:53:30+00:00","triaged_at":"2026-11-09T22:58:26+00:00","updated_at":"2026-11-09T22:58:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T22:58:26Z","model":"claude-haiku-5-5","output":{"fix":"- `laravel/framework` `13.40.0` and later in the 13.x line\n- Back-ported to the 12.x line; the exact 12.x fixed version is unknown from the sources","reach":"internet","title":"Laravel: concurrency task output can forge a result and run code","impact":"high","summary":"When a Laravel concurrency task prints user-controlled text to stdout, an attacker can forge the framework's internal result message. The advisory says this can lead to remote code execution under specific coding patterns.","audience":"developers","category":"package","nicknames":[],"who_cares":["laravel","php","composer"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker forges result message, possibly running code on server","analyst_note":"Confirm the exact fixed 12.x version and whether the advisory's RCE claim is conditional as described; check the linked maintainer advisory on GitHub.","how_to_check":"- Run `composer show laravel/framework` and compare the installed version with the fixed range.\n- Search the app for `Concurrency::run(` and check whether any task echoes, prints or dumps user input to stdout.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-concurrency-run"],"who_is_affected":"Only applications that call Concurrency::run() from a route and have a task that writes user-controlled data to stdout. The advisory says this requires app code that handles input insecurely, so default setups are not exposed. Applications that do not use Concurrency::run() can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000768,"input_tokens":4764,"output_tokens":584,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'1':103C '12':187C '13.40.0':182C '2':119C '2m2q':10A,15A '63hm':8A,13A 'achiev':78C 'advisori':44B 'app':104C,117C,179C 'attack':34B,68C 'back':184C 'back-port':183C 'built':135C 'byte':149C 'certain':83C 'child':156C 'code':51B,55B,80C,89C,118C,175C,180C 'complet':162C 'compos':17B 'concat':139C 'concurr':4A,24B,60C,110C 'condit':84C 'control':29B,65C,125C,148C 'data':126C 'dd':130C 'default':114C,171C 'dev':97C 'document':164C 'echo/print':129C 'execut':52B,81C 'follow':165C 'forg':36B,70C 'form':160C 'framework':38B,72C 'g96r':9A,14A 'ghsa':7A,12A 'ghsa-63hm-g96r-2m2q':6A,11A 'hand':134C 'hand-built':133C 'handl':92C 'inject':3A 'input':96C,102C,132C 'insecur':88C,91C 'intern':40B,74C 'json':136C,163C 'laravel':18B,23B 'laravel/framework':16A 'lead':48B 'made':152C 'messag':42B,76C 'output':2A,143C 'packag':19B 'passthrough':140C 'patch':181C 'pattern':56B,176C 'php':20B 'port':185C 'pre':86C 'pre-req':85C 'print':26B,62C 'process':5A 'provid':95C,101C 'reach':109C 'remot':50B,79C 'req':87C 'requir':116C,172C 'result':41B,75C 'rout':107C 'run':111C 'say':45B 'specif':54B,174C 'start':154C 'stdout':32B,128C,158C 'string':138C 'summari':57C 'task':1A,25B,61C,121C 'text':30B,66C 'tool':142C 'trust':98C 'user':28B,64C,94C,100C,124C,147C 'user-control':27B,63C,123C,146C 'user-provid':99C 'via':137C 'well':190C 'write':122C 'x':188C 'x1f':167C 'x8b':168C","nicknames":[],"mitigations":[],"who_affected":"Only applications that call Concurrency::run() from a route and have a task that writes user-controlled data to stdout. The advisory says this requires app code that handles input insecurely, so default setups are not exposed. Applications that do not use Concurrency::run() can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["laravelframework"],"ptokens":["framework","laravel"],"labels":["composer","laravel","low","package","php"],"campaign_type":null,"search_a":"'2m2q':10A,15A '63hm':8A,13A 'concurr':4A 'g96r':9A,14A 'ghsa':7A,12A 'ghsa-63hm-g96r-2m2q':6A,11A 'inject':3A 'laravel/framework':16A 'output':2A 'process':5A 'task':1A","search_b":"'advisori':44B 'attack':34B 'code':51B,55B 'compos':17B 'concurr':24B 'control':29B 'execut':52B 'forg':36B 'framework':38B 'intern':40B 'laravel':18B,23B 'lead':48B 'messag':42B 'packag':19B 'pattern':56B 'php':20B 'print':26B 'remot':50B 'result':41B 'say':45B 'specif':54B 'stdout':32B 'task':25B 'text':30B 'user':28B 'user-control':27B","search_c":"'1':103C '12':187C '13.40.0':182C '2':119C 'achiev':78C 'app':104C,117C,179C 'attack':68C 'back':184C 'back-port':183C 'built':135C 'byte':149C 'certain':83C 'child':156C 'code':80C,89C,118C,175C,180C 'complet':162C 'concat':139C 'concurr':60C,110C 'condit':84C 'control':65C,125C,148C 'data':126C 'dd':130C 'default':114C,171C 'dev':97C 'document':164C 'echo/print':129C 'execut':81C 'follow':165C 'forg':70C 'form':160C 'framework':72C 'hand':134C 'hand-built':133C 'handl':92C 'input':96C,102C,132C 'insecur':88C,91C 'intern':74C 'json':136C,163C 'made':152C 'messag':76C 'output':143C 'passthrough':140C 'patch':181C 'pattern':176C 'port':185C 'pre':86C 'pre-req':85C 'print':62C 'provid':95C,101C 'reach':109C 'remot':79C 'req':87C 'requir':116C,172C 'result':75C 'rout':107C 'run':111C 'specif':174C 'start':154C 'stdout':128C,158C 'string':138C 'summari':57C 'task':61C,121C 'text':66C 'tool':142C 'trust':98C 'user':64C,94C,100C,124C,147C 'user-control':63C,123C,146C 'user-provid':99C 'via':137C 'well':190C 'write':122C 'x':188C 'x1f':167C 'x8b':168C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-04T09:13:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-63hm-g96r-2m2q","url":"https://github.com/laravel/framework/security/advisories/GHSA-63hm-g96r-2m2q","severity":"low","published_at":"2026-11-04T09:13:11+00:00","modified_at":"2026-11-04T09:13:11+00:00","first_seen_at":"2026-11-09T22:53:30+00:00","fetched_at":"2026-11-09T22:53:30+00:00","note":null}],"documents":[{"id":110687,"url":"https://github.com/laravel/framework/security/advisories/GHSA-63hm-g96r-2m2q","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}