{"action":"Upgrade facade/ignition to 1.6.15 or later.","affected":[{"fixed":"2.5.2","introduced":"2.5.0"},{"fixed":"2.4.2","introduced":"2.0.0"},{"fixed":"1.16.14","introduced":"1.7.0"},{"fixed":"1.6.15","introduced":"0"}],"component":"facade/ignition","cve_ids":["CVE-2021-3129"],"ecosystem":"Packagist","epss":0.99943,"exploited":true,"fixed_versions":["2.5.2","2.4.2","1.16.14","1.6.15"],"ghsa_id":"GHSA-4qwp-7c67-jmcc","id":"tcs_01M5KEV7MPC6T5XGY9FEW2GKGT","modified_at":"2025-10-22T19:32:22.659838Z","published_at":"2021-03-29T20:23:46Z","references":["https://osv.dev/vulnerability/GHSA-4qwp-7c67-jmcc","https://nvd.nist.gov/vuln/detail/CVE-2021-3129","https://github.com/facade/ignition/pull/334","https://github.com/facade/ignition/commit/11ffca14abd22db779d90b12e193f8000f6d184b","https://github.com/FriendsOfPHP/security-advisories/blob/master/facade/ignition/CVE-2021-3129.yaml","https://github.com/facade/ignition","https://www.ambionics.io/blog/laravel-debug-rce","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129","http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-4qwp-7c67-jmcc","url":"https://osv.dev/vulnerability/GHSA-4qwp-7c67-jmcc"},{"source":"kev","source_id":"CVE-2021-3129","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Unauthenticated remote code execution in Ignition"}