Read the docs
TI-2024-38772 Aliases GHSA-vgxh-x8jv-hmff

silverstripe/framework code execution vulnerability

Priority LOW 38CWE-74Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

There is a vulnerability whereby arbitrary global functions may be executed if malicious user input is passed through to in the second argument of `ViewableData::renderWith`. This argument resolves associative arrays as template placeholders. This exploit requires that user code has been written which makes use of the second argument in `renderWith` and where user input is passed directly as a value in an associative array without sanitisation such as `Convert::raw2xml()`. `ViewableData::customise` is not vulnerable.

Why it matters now

Fix Fixed silverstripe/framework (Packagist): 4.0.4, 4.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—silverstripe/framework (Packagist)4.0.3-rc1 to before 4.0.44.0.4Patch availableGHSA-vgxh-x8jv-hmff
—silverstripe/framework (Packagist)4.1.0-rc1 to before 4.1.14.1.1Patch availableGHSA-vgxh-x8jv-hmff
  • silverstripe/framework (Packagist) Vendor— Affected 4.0.3-rc1 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-vgxh-x8jv-hmff
  • silverstripe/framework (Packagist) Vendor— Affected 4.1.0-rc1 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-vgxh-x8jv-hmff

Remediation

  • Fix · GHSA-vgxh-x8jv-hmff silverstripe/framework (Packagist) Fixed in 4.0.4 Advisory →
  • Fix · GHSA-vgxh-x8jv-hmff silverstripe/framework (Packagist) Fixed in 4.1.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-vgxh-x8jv-hmff

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences