porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories  /  composer  /  psy

composer

psy/psysh

Security advisories for psy/psysh, newest first. 1 known, 1 without a fix yet.

RSS feed Check your lock file →

Latest version

0.12.24

Advisories

1 · 1 unfixed

Last advisory

30 Jan 2026

Safe from

no fix for all yet

1 advisory · newest first

MODERATE6.7 30 Jan 2026

PsySH has Local Privilege Escalation via CWD .psysh.php auto-load

GHSA-4486-gxhx-5mg7 · CVE-2026-25129

Affected

≤ 0.11.22 ≥ 0.12.0, ≤ 0.12.18

Fixed in

no fix yet
/advisories/composer/psy/psysh/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →