{"action":"Upgrade solspace/craft-freeform to 5.10.14 or later.","affected":[{"fixed":"5.10.14","introduced":"5.0.0"}],"component":"solspace/craft-freeform","cve_ids":["CVE-2026-73858"],"ecosystem":"Packagist","epss":0.00549,"exploited":false,"fixed_versions":["5.10.14"],"ghsa_id":"GHSA-gxrg-x694-283w","id":"tcs_01M5KF36TNGGXFPNM7DDFW29V8","modified_at":"2026-09-23T14:45:06.326194791Z","published_at":"2026-09-23T14:31:10Z","references":["https://osv.dev/vulnerability/GHSA-gxrg-x694-283w","https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w","https://github.com/solspace/craft-freeform/pull/1986","https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b","https://github.com/solspace/craft-freeform","https://github.com/solspace/craft-freeform/releases/tag/v5.10.14"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-gxrg-x694-283w","url":"https://osv.dev/vulnerability/GHSA-gxrg-x694-283w"}],"summary":"Solspace Freeform: Limited Twig template injection via submitted field values"}