LowGHSA-63hm-g96r-2m2qCVE-2026-128083

Laravel: Task Output Injection - Concurrency Process

Published 13 Nov 2026 · Updated 13 Nov 2026

Is your project on an affected laravel/framework?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Look after several Laravel or PHP apps? Indie watches up to 15 repos, private ones too, for $5 a month. See Indie

Affected packages

laravel/frameworkComposer
Affected
<12.71.0
Fixed in
12.71.0
Update to the fixed version for your release line, for example:composer require laravel/framework:^12.71.0
laravel/frameworkComposer
Affected
>=13.0.0 <13.40.0
Fixed in
13.40.0
Update to the fixed version for your release line, for example:composer require laravel/framework:^13.40.0

Details

Summary

If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions

Pre-reqs

Insecure code and insecure handling of user provided input (devs trust user-provided input) :

1. App has a route that reaches Concurrency::run() (Not by default, it requires app code)

2. The task writes user-controlled data to stdout (echo/print/dd of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)

Patches

  • 13.40.0
  • 12.71.0

Is GHSA-63hm-g96r-2m2q in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected laravel/framework, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

More advisories for laravel/framework

  • CriticalCVE-2026-114509Laravel TokenGuard authentication bypass through non-string API credentials · 23 Oct 2026
  • MediumCVE-2026-114508Laravel relationship inclusion can trigger unauthorized data destruction · 23 Oct 2026
  • LowCVE-2026-102279Laravel: XSS in Debug Page Information · 29 Sept 2026
  • MediumGHSA-crmm-hgp2-wgrpLaravel Framework: Temporary Signed URL Path Confusion · 17 Jun 2026
  • HighCVE-2026-48019Laravel Framework: CRLF injection in default email rule · 17 Jun 2026
  • MediumCVE-2024-13918Laravel framework susceptible to reflected cross-site scripting · 10 Mar 2025
All 29 advisories for laravel/framework

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.