Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS14 APR
graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
no fix yet
10 APR
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
fixed in 1.0.10
6 APR
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
fixed in 7.3.2 · 8.0.5
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
fixed in 7.3.2 · 8.0.5
1 APR
lodash vulnerable to Code Injection via `_.template` imports key names
fixed in 4.18.0
lodash vulnerable to Code Injection via `_.template` imports key names
fixed in 4.18.0
lodash vulnerable to Code Injection via `_.template` imports key names
fixed in 4.18.0
lodash vulnerable to Code Injection via `_.template` imports key names
fixed in 4.18.0
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
fixed in 4.18.0
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
fixed in 4.18.0
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
fixed in 4.18.0
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
fixed in 4.18.0
27 MAR
AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
no fix yet
26 MAR
Statamic allows unauthorized content access through missing authorization in its revision controllers
fixed in 5.73.16 · 6.7.2
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
fixed in 5.73.16 · 6.7.2
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
fixed in 5.73.16 · 6.7.2
Statamic's live preview token bypasses content protection for unrelated entries
fixed in 5.73.16 · 6.7.2
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
fixed in 5.73.16 · 6.7.2
Statamic's Markdown preview endpoint exposes sensitive user data
fixed in 5.73.16 · 6.7.2
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
no fix yet
25 MAR
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
fixed in 3.0.2 · 4.0.4
Picomatch has a ReDoS vulnerability via extglob quantifiers
fixed in 3.0.2 · 4.0.4
24 MAR
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
no fix yet
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
no fix yet
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
no fix yet
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
no fix yet
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.