Cross site scripting vulnerability in Javascript escaping in smarty/smarty
Priority LOW 33CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.
Why it matters now
EPSS 0.01016 63rd percentileScored 2026-11-08
Fix Fixed smarty (smarty-php): 4.3.1, 3.1.48smarty/smarty (Packagist): 4.3.1, 3.1.48
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| smarty-php | smarty | 4.0.0 to before 4.3.1; before 3.1.48 | 4.3.1, 3.1.48 | Patch available | CNA |
| — | smarty/smarty (Packagist) | 4.0.0 to before 4.3.1 | 4.3.1 | Patch available | GHSA-7j98-h7fp-4vwj |
| — | smarty/smarty (Packagist) | before 3.1.48 | 3.1.48 | Patch available | GHSA-7j98-h7fp-4vwj |
- smarty Vendorsmarty-php Affected 4.0.0 to before 4.3.1; before 3.1.48 Fixed in 4.3.1, 3.1.48 Patch available CNA
- smarty/smarty (Packagist) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-7j98-h7fp-4vwj
- smarty/smarty (Packagist) Vendor— Affected before 3.1.48 Fixed in 3.1.48 Patch available GHSA-7j98-h7fp-4vwj
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:smarty:smarty:*:*:*:*:*:*:*:* | before 3.1.48; 4.0.0 to before 4.3.1 | Vulnerable | smarty-php |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:smarty:smarty:*:*:*:*:*:*:*:* Versions before 3.1.48; 4.0.0 to before 4.3.1 Vulnerable ·smarty-php
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA smarty (smarty-php) Fixed in 4.3.1, 3.1.48
- Fix · GHSA-7j98-h7fp-4vwj smarty/smarty (Packagist) Fixed in 4.3.1 Advisory →
- Fix · GHSA-7j98-h7fp-4vwj smarty/smarty (Packagist) Fixed in 3.1.48 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28447
- 2026-10-03 Alias added: GHSA-7j98-h7fp-4vwj
References
Advisory 5
- https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP/
- https://nvd.nist.gov/vuln/detail/CVE-2023-28447
Other 6
- https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2023-28447.yaml
- https://github.com/smarty-php/smarty
- https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP
More smarty-php Smarty vulnerabilities
- TI-2021-08070 Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. CVSS 3.1CRITICAL 9.8
- TI-2009-01585 The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22… CVSS 2.0HIGH 10.0
- TI-2006-06846 PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows… CVSS 3.1CRITICAL 9.8
- TI-2022-11764 PHP Code Injection by malicious block or filename in Smarty CVSS 3.1HIGH 8.8
- TI-2017-14689 Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or… CVSS 3.0CRITICAL 9.8
- TI-2010-04450 Smarty before 3.0.0 beta 7 does not properly handle the <?php and ?> tags, which has… CVSS 2.0HIGH 10.0
Sources
- CVE-2023-28447 · CVE Program
- CVE-2023-28447 · NVD
- FIRST EPSS
- GHSA-7j98-h7fp-4vwj · GitHub Advisory Database · CC BY 4.0
- CVE-2023-28447 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences