Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

knplabs/knp-snappy

4 known vulnerabilities (2 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 critical, 1 high, 1 medium
Registry
Packagist

Advisories 4

  • CVE-2026-46683Medium 6.9

    Snappy: SSRF and local file read via the xsl-style-sheet option

    Affected: fixed in 1.7.0.

  • Snappy: Binary path is never shell-escaped due to an inverted is_executable check

    Affected: fixed in 1.7.1.

  • CVE-2023-41330Critical 9.8

    Unsafe deserialization in knplabs/knp-snappy

    Affected: fixed in 1.4.3.

  • CVE-2023-28115Critical 9.8

    Snappy vulnerable to PHAR deserialization, allowing remote code execution

    Affected: fixed in 1.4.2.