{"action":"Upgrade statamic/cms to 5.73.24 or later.","affected":[{"fixed":"6.20.1","introduced":"6.0.0"},{"fixed":"5.73.24","introduced":"0"}],"component":"statamic/cms","cve_ids":["CVE-2026-54243"],"ecosystem":"Packagist","epss":0.00338,"exploited":false,"fixed_versions":["6.20.1","5.73.24"],"ghsa_id":"GHSA-h77m-qrj7-jxcw","id":"tcs_01M5KF3EQCG3QCREQ94C9GP13N","modified_at":"2026-09-10T03:50:49.759882966Z","published_at":"2026-06-26T23:03:56Z","references":["https://osv.dev/vulnerability/GHSA-h77m-qrj7-jxcw","https://github.com/statamic/cms/security/advisories/GHSA-h77m-qrj7-jxcw","https://github.com/statamic/cms"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-h77m-qrj7-jxcw","url":"https://osv.dev/vulnerability/GHSA-h77m-qrj7-jxcw"}],"summary":"Statamic Vulnerable to CSV formula injection in form submission exports"}