CVE-2021-47756
Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)
- State
- Published
- Severity
- 8.4 High
- Published
- Jan 15, 2026
- Updated
- Aug 14, 2026
- Reserved
- Jan 10, 2026
Description
Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without additional authentication.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.4 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-732 Incorrect Permission Assignment for Critical Resource
Affected Products
| Product | Versions |
|---|---|
Laravel ValetLaravel |
|
References
- ExploitDB-50591exploit
- Laravel Valet Official Documentationproduct
- VulnCheck Advisory: Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.