Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS9 FEB
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
no fix yet
30 JAN
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
no fix yet
28 JAN
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
fixed in 5.4.51 · 6.4.33 · 7.3.11 · 7.4.5 · 8.0.5
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
fixed in 7.5.7
27 JAN
Unsafe Deserialization in PHPT Code Coverage Handling
fixed in 8.5.52 · 9.6.33 · 10.5.62 · 11.5.50 · 12.5.8
21 JAN
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
fixed in 4.17.23
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
fixed in 4.17.23
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
no fix yet
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
fixed in 4.17.23
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
fixed in 7.5.4
16 JAN
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
fixed in 7.5.3
5 JAN
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
no fix yet
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
no fix yet
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
no fix yet
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
no fix yet
31 DEC 2025
libsodium has Incomplete List of Disallowed Inputs
fixed in 1.24.0 · 2.5.0
30 DEC 2025
Missing check that a point is on the prime subgroup for Edwards25519
fixed in 1.24.0 · 2.5.0
17 DEC 2025
12 NOV 2025
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
fixed in 5.4.50 · 6.4.29 · 7.3.7
30 OCT 2025
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
no fix yet
20 OCT 2025
vite allows server.fs.deny bypass via backslash on Windows
fixed in 7.0.8 · 7.1.11
9 SEP 2025
Vite middleware may serve files starting with the same name with the public directory
fixed in 7.0.7 · 7.1.5
25 AUG 2025
12 AUG 2025
svg-sanitizer Bypasses Attribute Sanitization
fixed in 0.22.0
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.