GitHub's Advisory Database published a Laravel advisory on 13 November 2026. It says that when a concurrency task prints text a user controls, an attacker can forge the framework's internal result message. In certain conditions, the advisory says, this gives the attacker remote code execution. That means they can run their own code on the server.
The advisory says this is not the default setup. An app needs a route that reaches Concurrency::run(). The task must also write user-controlled data to its output, for example through echo, print, or JSON built by hand. The user's bytes must start the child's output and form a complete JSON document, followed by the bytes \x1f\x8b. The advisory links to Laravel releases v12.71.0 and v13.40.0. It gives no severity score, no CVE number and no list of affected versions. It does not say what those releases change.
For teams that run Laravel, exposure depends on their own code, not on the framework alone. The advisory points to one pattern: user input that ends up in the output of a concurrency task. Developers can check whether any such task prints input from users.