dedoc/scramble

Modern Laravel OpenAPI (Swagger) documentation generator. No PHPDoc annotations required.

View on Packagist

View on Github

Activity

Latest release: 6d ago
Total releases: 154
Cadence: ~5 days
Last 12 months: 45

Reach

Stars: 2.2k

Details

License: MIT
First release: Aug 19, 2022

Releases

Version	Released
`0.13.43` patch	Sep 08, 2026
`v0.13.42` patch	Aug 21, 2026
`v0.13.41` patch	Aug 14, 2026
`v0.13.40` patch	Aug 11, 2026
`v0.13.39` patch	Aug 06, 2026
`v0.13.38` patch	Aug 04, 2026
`v0.13.37` patch	Aug 02, 2026
`v0.13.36` patch	Jul 27, 2026
`v0.13.35` patch	Jul 15, 2026
`v0.13.34` patch	Jul 12, 2026
`v0.13.33` patch	Jul 11, 2026
`v0.13.32` patch	Jul 09, 2026
`v0.13.31` patch	Jul 07, 2026
`v0.13.30` patch	Jun 26, 2026
`v0.13.29` patch	Jun 24, 2026
`v0.13.28` patch	Jun 14, 2026
`v0.13.27` patch	Jun 12, 2026
`v0.13.26` patch	Jun 02, 2026
`v0.13.25` patch	Jun 02, 2026
`v0.13.24` patch	May 29, 2026
`v0.13.23` patch	May 19, 2026
`v0.13.22` patch	Apr 27, 2026
`v0.13.21` patch 1 CVE	Apr 26, 2026
`v0.13.20` patch 1 CVE	Apr 16, 2026
`v0.13.19` patch 1 CVE	Apr 15, 2026
`v0.13.18` patch 1 CVE	Apr 10, 2026
`v0.13.17` patch 1 CVE	Mar 27, 2026
`v0.13.16` patch 1 CVE	Mar 17, 2026
`v0.13.15` patch 1 CVE	Mar 12, 2026
`v0.13.14` patch 1 CVE	Feb 15, 2026
`v0.13.13` patch 1 CVE	Feb 12, 2026
`v0.13.12` patch 1 CVE	Feb 05, 2026
`v0.13.11` patch 1 CVE	Jan 28, 2026
`v0.13.10` patch 1 CVE	Dec 29, 2025
`v0.13.9` patch 1 CVE	Dec 27, 2025
`v0.13.8` patch 1 CVE	Dec 08, 2025
`v0.13.7` patch 1 CVE	Dec 03, 2025
`v0.13.6` patch 1 CVE	Nov 30, 2025
`v0.13.5` patch 1 CVE	Nov 24, 2025
`v0.13.4` patch 1 CVE	Nov 16, 2025
`v0.13.3` patch 1 CVE	Nov 12, 2025
`v0.13.2` patch 1 CVE	Oct 30, 2025
`v0.13.1` patch	Oct 26, 2025
`v0.13.0` minor	Oct 23, 2025
`v0.12.36` patch	Oct 20, 2025
`v0.12.35` patch	Sep 24, 2025
`v0.12.34` patch	Sep 09, 2025
`v0.12.33` patch	Sep 09, 2025
`v0.12.32` patch	Sep 08, 2025
`v0.12.31` patch	Aug 24, 2025

1–50 of 154

Repository

dedoc/scramble

Forks: 207
Open issues: 11
Language: PHP

laravel
openapi
api
generator
swagger

Dependencies (5)

Depends on

0.13.43

Used by

Supply-chain exposure

76 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-44262 GHSA-4rm2-28vj-fj39 May 06, 2026

Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules

9.4 / 10
Critical
Network Low None None Unchanged High High Low

Impact

A remote code execution (RCE) vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.

Patches

Fixed in version 0.13.22.

Workarounds

If upgrading is not immediately possible:

Restrict access to documentation endpoints (/docs/api, /docs/api.json)

Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input)

Disable documentation endpoints in production environments if not required

These measures significantly reduce or prevent exploitability.

Affected versions

v0.13.10v0.13.11v0.13.12v0.13.13v0.13.14v0.13.15v0.13.16v0.13.17v0.13.18v0.13.19v0.13.2v0.13.20

+ 8 more Show less

v0.13.21v0.13.3v0.13.4v0.13.5v0.13.6v0.13.7v0.13.8v0.13.9

Fixed in

0.13.22

References

https://github.com/dedoc/scramble/security/advisories/GHSA-4rm2-28vj-fj39
https://nvd.nist.gov/vuln/detail/CVE-2026-44262
https://github.com/dedoc/scramble
https://github.com/dedoc/scramble/releases/tag/v0.13.22

Updated May 13, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 13
patch 134
pre 6

154 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More