A local privilege escalation vulnerability in Laravel Valet versions 1.1.4 through 2.0.3 allows a local user to execute arbitrary code with root privileges.

The application incorrectly handles file permissions for the valet command, which is symlinked to a location writable by the user. Because the system allows the valet command to be executed with root privileges via sudoers rules without requiring a password, an attacker can modify the command to execute arbitrary code as root.

Successful exploitation allows a local attacker to gain full administrative control over the affected macOS system. This leads to complete system compromise, including the ability to access sensitive data, install persistent backdoors, or modify system configurations. With a CVSS score of 8.4, this vulnerability represents a high risk to organizational security in environments where multiple users share access to development workstations.

Immediate Action: Update Laravel Valet to a version beyond 2.0.3, as the vulnerability is addressed in later releases. If updating is not immediately feasible, verify the sudoers configuration to ensure that non-privileged users cannot execute the valet command with root privileges.

Proactive Monitoring: Review system logs for unauthorized use of sudo commands and monitor the integrity of the /usr/local/bin/valet symlink and the corresponding source file.

Compensating Controls: Restrict local user access to development environments and ensure that users follow the principle of least privilege when performing administrative tasks on workstations.

Public Exploit Available: Yes, a public proof-of-concept exists and is documented in the Exploit Database (EDB-ID: 50591).

Given the availability of a public proof-of-concept and the high severity of the privilege escalation, immediate remediation is required. Administrators should ensure all Laravel Valet installations are updated to patched versions to prevent unauthorized root access and maintain the security integrity of the local environment.