CVE-2026-128083: Laravel: Task Output Injection - Concurrency Process
Summary
If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions
Pre-reqs
Insecure code and insecure handling of user provided input (devs trust user-provided input) :
1. App has a route that reaches Concurrency::run() (Not by default, it requires app code)
2. The task writes user-controlled data to stdout (echo/print/dd of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)
Patches 13.40.0 12.71.0
Other sources
Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled bytes at the start of the child's standard output that form a complete JSON document followed by gzip magic bytes. Under those application-specific conditions, an attacker can forge the internal result message and achieve remote code execution. The affected behavior is not exposed by default and requires application code that routes untrusted input into task output. This issue is fixed in versions 12.71.0 and 13.40.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/laravel/frameworkto a version that resolves this vulnerability.Fixed in 13.40.0 - Upgrade
Upgrade
composer/laravel/frameworkto a version that resolves this vulnerability.Fixed in 12.71.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.71.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 13.40.0
Event History
Frequently Asked Questions
Are Laravel applications affected by default?
No. Exploitation requires application-specific code: a route must invoke Concurrency::run using the process driver, and a task must emit attacker-controlled data at the beginning of its standard output.
What must an attacker be able to control to exploit this issue?
The attacker must be able to cause child-process stdout to begin with a complete forged JSON document followed by the gzip magic bytes (\x1f\x8b). This can arise from echoing, printing, or dumping user input, constructing JSON through string concatenation, or passing through tool output.
What versions contain the fixes?
The listed patched versions are Laravel 12.71.0 and 13.40.0. Versions prior to those releases are affected when the application-specific exploitation conditions are present.
What can be done if upgrading is not immediately possible?
Remove or prevent routes from reaching Concurrency::run where possible. Review concurrency tasks and ensure they do not write user-controlled or untrusted tool output to stdout, especially as the first bytes of task output.
How can teams identify potentially exposed code?
Audit application routes that invoke Concurrency::run and inspect their tasks for stdout writes such as echo, print, dd, manually concatenated JSON, or forwarded command output. Prioritize cases where an external user can influence that output and cause it to appear first.