Read the docs
TI-2017-14253 Aliases CVE-2017-20187GHSA-8pp6-5qpw-85g3

Magnesium-PHP Base.php formatEmailString injection

Priority MEDIUM 44CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00833 57th percentileScored 2026-11-07
Fix Fixed floriangaerber/magnesium (Packagist): 0.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Magnesium-PHP0.1; 0.2; 0.3—No fix listedCNA
—floriangaerber/magnesium (Packagist)before 0.3.10.3.1Patch availableGHSA-8pp6-5qpw-85g3
  • Magnesium-PHP Vendor— Affected 0.1; 0.2; 0.3 Fixed in — No fix listed CNA
  • floriangaerber/magnesium (Packagist) Vendor— Affected before 0.3.1 Fixed in 0.3.1 Patch available GHSA-8pp6-5qpw-85g3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:floriangaerber:magnesium-php:*:*:*:*:*:*:*:*up to 0.3.0VulnerableFloriangaerber
  • cpe:2.3:a:floriangaerber:magnesium-php:*:*:*:*:*:*:*:* Versions up to 0.3.0 Vulnerable ·Floriangaerber

Remediation

  • Fix · GHSA-8pp6-5qpw-85g3 floriangaerber/magnesium (Packagist) Fixed in 0.3.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-20187
  2. 2026-10-03 Alias added: GHSA-8pp6-5qpw-85g3

References

Patch 2

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences