CVE-2024-35226
1 advisory.
Packagist/smarty/smarty CVE-2024-35226: high 7.3
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
Action: Upgrade smarty/smarty to 4.5.3 or later.
composer require smarty/smarty:5.1.1composer require smarty/smarty:4.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.1.1 | - |
| 3.0.0 | 4.5.3 | - |
Fixed versions
| 5.1.1 | 4.5.3 |
Sources
- osv: GHSA-4rmg-292m-wg3w
- https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w
- https://nvd.nist.gov/vuln/detail/CVE-2024-35226
- https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a
- https://github.com/smarty-php/smarty
- https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html
CVE-2024-35226 · published · modified · JSON