composer

nesbot/carbon

Security advisories for nesbot/carbon, newest first. 1 known, all fixed. If you’re on 3.8.4 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

3.15.1

Advisories

1 · 0 unfixed

Last advisory

8 Jan 2025

Safe from

3.8.4

1 advisory · newest first

MODERATE 8 Jan 2025

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

GHSA-j3f9-p6hm-5w6q · CVE-2025-22145

Affected

< 2.72.6 ≥ 3.0.0, < 3.8.4

Fixed in

2.72.6 3.8.4

Published

8 Jan 2025

/advisories/composer/nesbot/carbon/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →