{"action":"Upgrade KnpLabs/knp-snappy to 1.7.1 or later.","affected":[{"fixed":"1.7.1","introduced":"0"}],"component":"KnpLabs/knp-snappy","cve_ids":["CVE-2026-46643"],"ecosystem":"Packagist","epss":0.002,"exploited":false,"fixed_versions":["1.7.1"],"ghsa_id":"GHSA-vpr4-p6fq-85jc","id":"tcs_01M5KF9B1PMKXPP07SG65SA9XK","modified_at":"2026-09-10T03:51:07.228885258Z","published_at":"2026-05-21T20:22:16Z","references":["https://osv.dev/vulnerability/GHSA-vpr4-p6fq-85jc","https://github.com/KnpLabs/snappy/security/advisories/GHSA-vpr4-p6fq-85jc","https://nvd.nist.gov/vuln/detail/CVE-2026-46643","https://github.com/KnpLabs/snappy","https://github.com/KnpLabs/snappy/releases/tag/v1.7.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vpr4-p6fq-85jc","url":"https://osv.dev/vulnerability/GHSA-vpr4-p6fq-85jc"},{"source":"nvd","source_id":"CVE-2026-46643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46643"}],"summary":"Snappy: Binary path is never shell-escaped due to an inverted is_executable check"}