Threats affecting pkg:github/dedoc/scramble

CVE-2026-44262 is a critical code injection vulnerability in dedoc's scramble tool versions 0.13.2 up to but not including 0.13.22. The vulnerability arises when documentation endpoints are publicly accessible and validation rules incorporate user-controlled input, enabling arbitrary PHP code execution during API documentation generation. This flaw has a high CVSS score of 9.4, indicating severe confidentiality and integrity impacts. The issue is fixed starting from version 0.13.22.