How severe is CVE-2026-128083?

No CVSS score has been assigned to CVE-2026-128083 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-128083?

CVE-2026-128083 affects the following packages: laravel/framework (Packagist), laravel/framework (Packagist). Ecosystems affected: Packagist.

How do I fix CVE-2026-128083?

Update laravel/framework to 12.71.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-128083 is resolved across your whole dependency graph.

How do I detect CVE-2026-128083 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for laravel/framework, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-128083 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is CVE-2026-128083 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-128083 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was CVE-2026-128083 published, and has it been updated?

CVE-2026-128083 was published on November 13, 2026 and was last updated on November 13, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

Not in CISA KEV

CVE-2026-128083 — framework

Fix: laravel/framework#62297

CVE-2026-128083 is a remote code execution vulnerability in laravel/framework. A fix is available for laravel/framework — see the affected versions and patch details below.

Laravel: Task Output Injection - Concurrency Process

Published

Nov 13, 2026

Updated

Nov 13, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Nov 13, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

🐘laravel/framework🐘laravel/framework

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions

Pre-reqs

Insecure code and insecure handling of user provided input (devs trust user-provided input) :

App has a route that reaches Concurrency::run() (Not by default, it requires app code)
The task writes user-controlled data to stdout (echo/print/dd of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)

Patches

13.40.0
12.71.0

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`laravel/framework`	all versions	12.71.0`composer require laravel/framework:^12.71.0`
🐘Packagist	`laravel/framework`	≥ 13.0.0&&< 13.40.0	13.40.0`composer require laravel/framework:^13.40.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for laravel/framework, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update laravel/framework to 12.71.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-128083 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions ### Pre-reqs Insecure code and insecure handling of user provided input (devs trust user-provided input) : 1. App has a route that reaches Concurrency::run() (Not by default, it requires app code) 2. The task writes user-controlled data to stdout (echo/print/`dd` of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and fo

O3 Security · Impact-Aware SCA

Is CVE-2026-128083 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works