Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSSYESTERDAY · 28 OCT
CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
fixed in 5.4.55 · 6.4.49 · 7.4.22 · 8.1.10
27 OCT
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
no fix yet
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
no fix yet
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
no fix yet
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
no fix yet
PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling
fixed in 13.4.4
23 OCT
Laravel TokenGuard authentication bypass through non-string API credentials
fixed in 12.68.0 · 13.29.0
Laravel relationship inclusion can trigger unauthorized data destruction
fixed in 12.68.0 · 13.27.0
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
fixed in 4.4.8
21 OCT
Vite: Cross origin script execution through Vite custom middleware
fixed in 8.2.4 · 8.3.3
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
fixed in 1.1.0
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
fixed in 8.2.4 · 8.3.3
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
fixed in 1.1.0
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
fixed in 8.2.4 · 8.3.3
20 OCT
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
fixed in 1.1.0
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
fixed in 8.3.3
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
fixed in 2.14.2
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
fixed in 1.1.0
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
fixed in 8.3.3
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
fixed in 2.14.2
launch-editor: escapeCmdArgs() omits % escaping on Windows
fixed in 2.14.2
14 OCT
CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
fixed in 5.4.54 · 6.4.48 · 7.4.21 · 8.1.9
8 OCT
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
no fix yet
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
no fix yet
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.