VulnerableCode Package Details - pkg:composer/smarty/smarty@4.0.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-3829-yarc-yqh3 Aliases: CVE-2023-28447 GHSA-7j98-h7fp-4vwj	smarty Cross-site Scripting vulnerability in Javascript escaping An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user.	4.3.1 Affected by 0 other vulnerabilities.
VCID-jhg5-tdyz-uyh4 Aliases: CVE-2021-21408 GHSA-4h9c-v5vg-5m6m	Improper Input Validation Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. A vulnerability was found that may allow template authors could run restricted static php methods.	4.0.3 Affected by 0 other vulnerabilities.
VCID-mmfc-us8q-xbha Aliases: CVE-2021-29454 GHSA-29gp-2c3m-3j6m	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.	4.0.2 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-3829-yarc-yqh3
Aliases:
CVE-2023-28447
GHSA-7j98-h7fp-4vwj

smarty Cross-site Scripting vulnerability in Javascript escaping An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user.

4.3.1
Affected by 0 other vulnerabilities.

VCID-jhg5-tdyz-uyh4
Aliases:
CVE-2021-21408
GHSA-4h9c-v5vg-5m6m

Improper Input Validation Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. A vulnerability was found that may allow template authors could run restricted static php methods.

4.0.3
Affected by 0 other vulnerabilities.

VCID-mmfc-us8q-xbha
Aliases:
CVE-2021-29454
GHSA-29gp-2c3m-3j6m

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.

4.0.2
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:44:23.010458+00:00	GitLab Importer	Affected by	VCID-3829-yarc-yqh3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/smarty/smarty/CVE-2023-28447.yml	38.6.0
2026-06-02T04:40:54.814307+00:00	GitLab Importer	Affected by	VCID-jhg5-tdyz-uyh4	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/smarty/smarty/CVE-2021-21408.yml	38.6.0
2026-06-02T04:40:54.564458+00:00	GitLab Importer	Affected by	VCID-mmfc-us8q-xbha	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/smarty/smarty/CVE-2021-29454.yml	38.6.0