Laravel: Task Output Injection - Concurrency Process

Summary If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions Pre-reqs Insecure code and insecure handling of user provided input devs trust user-provided input : 1. App has a route...

GHSA-63HM-G96R-2M2Q Laravel: Task Output Injection - Concurrency Process

Summary If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions Pre-reqs Insecure code and insecure handling of user provided input devs trust user-provided input : 1. App has a route...

CVE-2026-128083 Laravel: Task Output Injection - Concurrency Process

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled byt...

CVE-2026-128083

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled byt...