{"action":"Upgrade cakephp/database to 5.1.10 or later.","affected":[{"fixed":"5.3.7","introduced":"5.3.0"},{"fixed":"5.2.15","introduced":"5.2.0"},{"fixed":"5.1.10","introduced":"5.1.0"}],"component":"cakephp/database","cve_ids":["CVE-2026-77635"],"ecosystem":"Packagist","epss":0.00493,"exploited":false,"fixed_versions":["5.3.7","5.2.15","5.1.10"],"ghsa_id":"GHSA-fxf7-vhh8-7vpq","id":"tcs_01M5KF2572X4TS4DN35VNCCPZP","modified_at":"2026-09-08T21:15:04.950966435Z","published_at":"2026-09-08T20:56:41Z","references":["https://osv.dev/vulnerability/GHSA-fxf7-vhh8-7vpq","https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq","https://nvd.nist.gov/vuln/detail/CVE-2026-77635","https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3","https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55","https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f","https://github.com/cakephp/cakephp","https://github.com/cakephp/cakephp/releases/tag/5.1.10","https://github.com/cakephp/cakephp/releases/tag/5.2.15","https://github.com/cakephp/cakephp/releases/tag/5.3.7"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-fxf7-vhh8-7vpq#Packagist/cakephp/database","url":"https://osv.dev/vulnerability/GHSA-fxf7-vhh8-7vpq"}],"summary":"CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver"}