Vulnerability in Laravel Valet
CVE-2021-47756
Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without additional authentication.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (9.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 9.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Laravel Valet — versions 1.1.4 to 2.0.3
Weakness classification (CWE)
References
- ExploitDB-50591 (exploit)
- Laravel Valet Official Documentation (product)
- VulnCheck Advisory: Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) (third-party-advisory)
Frequently asked questions
- What is CVE-2021-47756?
- CVE-2021-47756 is a high-severity vulnerability in Laravel Valet, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 8.4/10. Published 2026-01-16.
- How severe is CVE-2021-47756?
- High severity. CVSS v3 base score is 8.4 out of 10.