---
id: "GHSA-63hm-g96r-2m2q"
page: "https://infrastack.ai/live/GHSA-63hm-g96r-2m2q"
kind: "vulnerability"
aliases: ["GHSA-63hm-g96r-2m2q"]
title: "Task Output Injection - Concurrency Process"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "laravel/framework", "note": "<v13.40.0", "fixed": [">=v13.40.0"], "affected": "< v13.40.0", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["composer", "laravel", "package", "php"]
not_affected_if: ["default-config", "no-concurrency-run"]
published_at: "2026-11-04T09:13:11+00:00"
first_seen_at: "2026-11-09T22:53:30+00:00"
updated_at: "2026-11-09T22:58:26+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/laravel/framework/security/advisories/GHSA-63hm-g96r-2m2q", "first_seen_at": "2026-11-09T22:53:30+00:00"}]
exploit_sources: []
---

# Task Output Injection - Concurrency Process

Link for people: https://infrastack.ai/live/GHSA-63hm-g96r-2m2q (this .md is for agents)

When a Laravel concurrency task prints user-controlled text to stdout, an attacker can forge the framework's internal result message. The advisory says this can lead to remote code execution under specific coding patterns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:laravel/framework affected < v13.40.0 fixed >=v13.40.0

## How to check

- Run `composer show laravel/framework` and compare the installed version with the fixed range.
- Search the app for `Concurrency::run(` and check whether any task echoes, prints or dumps user input to stdout.

## Fix

- `laravel/framework` `13.40.0` and later in the 13.x line
- Back-ported to the 12.x line; the exact 12.x fixed version is unknown from the sources

## Timeline

- 2026-11-09T22:53:30+00:00 ghsa-repo https://github.com/laravel/framework/security/advisories/GHSA-63hm-g96r-2m2q

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/laravel/framework/security/advisories/GHSA-63hm-g96r-2m2q

## From the sources

### Summary

If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions

### Pre-reqs

Insecure code and insecure handling of user provided input (devs trust user-provided input) :

1. App has a route that reaches Concurrency::run() (Not by default, it requires app code)

2. The task writes user-controlled data to stdout (echo/print/`dd` of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b  (Not by default, requires the specific coding pattern in the app code)

### Patches
* 13.40.0
* back-ported to 12.x as well

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_