{"url":"http://public2.vulnerablecode.io/api/packages/104005?format=json","purl":"pkg:deb/debian/smarty3@3.1.45-1?distro=trixie","type":"deb","namespace":"debian","name":"smarty3","version":"3.1.45-1","qualifiers":{"distro":"trixie"},"subpath":"","is_vulnerable":false,"next_non_vulnerable_version":"3.1.47-1","latest_non_vulnerable_version":"3.1.48-2","affected_by_vulnerabilities":[],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/156419?format=json","vulnerability_id":"VCID-3mxe-phrs-j7d1","summary":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21408","reference_id":"","reference_type":"","scores":[{"value":"0.0047","scoring_system":"epss","scoring_elements":"0.65028","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21408"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21408","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21408"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29454","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29454"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29221","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29221"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010375","reference_id":"1010375","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010375"},{"reference_url":"https://github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664","reference_id":"19ae410bf56007a5ef24441cdc6414619cfaf664","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664"},{"reference_url":"https://security.gentoo.org/glsa/202209-09","reference_id":"202209-09","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://security.gentoo.org/glsa/202209-09"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/","reference_id":"BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21408","reference_id":"CVE-2021-21408","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21408"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-21408.yaml","reference_id":"CVE-2021-21408.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-21408.yaml"},{"reference_url":"https://www.debian.org/security/2022/dsa-5151","reference_id":"dsa-5151","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://www.debian.org/security/2022/dsa-5151"},{"reference_url":"https://github.com/advisories/GHSA-4h9c-v5vg-5m6m","reference_id":"GHSA-4h9c-v5vg-5m6m","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4h9c-v5vg-5m6m"},{"reference_url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-4h9c-v5vg-5m6m","reference_id":"GHSA-4h9c-v5vg-5m6m","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-4h9c-v5vg-5m6m"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/","reference_id":"L777JIBIWJV34HS7LXPIDWASG7TT4LNI","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html","reference_id":"msg00005.html","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html"},{"reference_url":"https://usn.ubuntu.com/5348-1/","reference_id":"USN-5348-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5348-1/"},{"reference_url":"https://usn.ubuntu.com/USN-5348-2/","reference_id":"USN-USN-5348-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-5348-2/"},{"reference_url":"https://usn.ubuntu.com/USN-5348-3/","reference_id":"USN-USN-5348-3","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-5348-3/"},{"reference_url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.43","reference_id":"v3.1.43","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.43"},{"reference_url":"https://github.com/smarty-php/smarty/releases/tag/v4.0.3","reference_id":"v4.0.3","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:17Z/"}],"url":"https://github.com/smarty-php/smarty/releases/tag/v4.0.3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/103995?format=json","purl":"pkg:deb/debian/smarty3@3.1.39-2%2Bdeb11u1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.39-2%252Bdeb11u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/104005?format=json","purl":"pkg:deb/debian/smarty3@3.1.45-1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.45-1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/103993?format=json","purl":"pkg:deb/debian/smarty3@3.1.47-2%2Bdeb12u1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.47-2%252Bdeb12u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/103996?format=json","purl":"pkg:deb/debian/smarty3@3.1.48-2?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.48-2%3Fdistro=trixie"}],"aliases":["CVE-2021-21408","GHSA-4h9c-v5vg-5m6m"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3mxe-phrs-j7d1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/156393?format=json","vulnerability_id":"VCID-g4mk-4raf-a3bj","summary":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-29454","reference_id":"","reference_type":"","scores":[{"value":"0.00643","scoring_system":"epss","scoring_elements":"0.71134","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-29454"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21408","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21408"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29454","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29454"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29221","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29221"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010375","reference_id":"1010375","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010375"},{"reference_url":"https://security.gentoo.org/glsa/202209-09","reference_id":"202209-09","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://security.gentoo.org/glsa/202209-09"},{"reference_url":"https://github.com/smarty-php/smarty/commit/215d81a9fa3cd63d82fb3ab56ecaf97cf1e7db71","reference_id":"215d81a9fa3cd63d82fb3ab56ecaf97cf1e7db71","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://github.com/smarty-php/smarty/commit/215d81a9fa3cd63d82fb3ab56ecaf97cf1e7db71"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/","reference_id":"BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29454","reference_id":"CVE-2021-29454","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29454"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-29454.yaml","reference_id":"CVE-2021-29454.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-29454.yaml"},{"reference_url":"https://www.debian.org/security/2022/dsa-5151","reference_id":"dsa-5151","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://www.debian.org/security/2022/dsa-5151"},{"reference_url":"https://github.com/advisories/GHSA-29gp-2c3m-3j6m","reference_id":"GHSA-29gp-2c3m-3j6m","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-29gp-2c3m-3j6m"},{"reference_url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-29gp-2c3m-3j6m","reference_id":"GHSA-29gp-2c3m-3j6m","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-29gp-2c3m-3j6m"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/","reference_id":"L777JIBIWJV34HS7LXPIDWASG7TT4LNI","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/"},{"reference_url":"https://www.smarty.net/docs/en/language.function.math.tpl","reference_id":"language.function.math.tpl","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://www.smarty.net/docs/en/language.function.math.tpl"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html","reference_id":"msg00005.html","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html"},{"reference_url":"https://packagist.org/packages/smarty/smarty","reference_id":"smarty","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://packagist.org/packages/smarty/smarty"},{"reference_url":"https://usn.ubuntu.com/5348-1/","reference_id":"USN-5348-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5348-1/"},{"reference_url":"https://usn.ubuntu.com/USN-5348-2/","reference_id":"USN-USN-5348-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-5348-2/"},{"reference_url":"https://usn.ubuntu.com/USN-5348-3/","reference_id":"USN-USN-5348-3","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-5348-3/"},{"reference_url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.42","reference_id":"v3.1.42","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.42"},{"reference_url":"https://github.com/smarty-php/smarty/releases/tag/v4.0.2","reference_id":"v4.0.2","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:57:13Z/"}],"url":"https://github.com/smarty-php/smarty/releases/tag/v4.0.2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/103995?format=json","purl":"pkg:deb/debian/smarty3@3.1.39-2%2Bdeb11u1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.39-2%252Bdeb11u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/104005?format=json","purl":"pkg:deb/debian/smarty3@3.1.45-1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.45-1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/103993?format=json","purl":"pkg:deb/debian/smarty3@3.1.47-2%2Bdeb12u1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.47-2%252Bdeb12u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/103996?format=json","purl":"pkg:deb/debian/smarty3@3.1.48-2?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.48-2%3Fdistro=trixie"}],"aliases":["CVE-2021-29454","GHSA-29gp-2c3m-3j6m"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g4mk-4raf-a3bj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/169334?format=json","vulnerability_id":"VCID-ke5v-yxmm-fydq","summary":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29221","reference_id":"","reference_type":"","scores":[{"value":"0.25501","scoring_system":"epss","scoring_elements":"0.96346","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-29221"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21408","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21408"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29454","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29454"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29221","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29221"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011757","reference_id":"1011757","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011757"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011758","reference_id":"1011758","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011758"},{"reference_url":"https://security.gentoo.org/glsa/202209-09","reference_id":"202209-09","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://security.gentoo.org/glsa/202209-09"},{"reference_url":"https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd","reference_id":"64ad6442ca1da31cefdab5c9874262b702cccddd","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/","reference_id":"BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29221","reference_id":"CVE-2022-29221","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29221"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2022-29221.yaml","reference_id":"CVE-2022-29221.YAML","reference_type":"","scores":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2022-29221.yaml"},{"reference_url":"https://www.debian.org/security/2022/dsa-5151","reference_id":"dsa-5151","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://www.debian.org/security/2022/dsa-5151"},{"reference_url":"https://github.com/advisories/GHSA-634x-pc3q-cf4c","reference_id":"GHSA-634x-pc3q-cf4c","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-634x-pc3q-cf4c"},{"reference_url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c","reference_id":"GHSA-634x-pc3q-cf4c","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/","reference_id":"L777JIBIWJV34HS7LXPIDWASG7TT4LNI","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00044.html","reference_id":"msg00044.html","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00044.html"},{"reference_url":"https://usn.ubuntu.com/6012-1/","reference_id":"USN-6012-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6012-1/"},{"reference_url":"https://usn.ubuntu.com/6550-1/","reference_id":"USN-6550-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6550-1/"},{"reference_url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.45","reference_id":"v3.1.45","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.45"},{"reference_url":"https://github.com/smarty-php/smarty/releases/tag/v4.1.1","reference_id":"v4.1.1","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:52:58Z/"}],"url":"https://github.com/smarty-php/smarty/releases/tag/v4.1.1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/103995?format=json","purl":"pkg:deb/debian/smarty3@3.1.39-2%2Bdeb11u1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.39-2%252Bdeb11u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/104005?format=json","purl":"pkg:deb/debian/smarty3@3.1.45-1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.45-1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/103993?format=json","purl":"pkg:deb/debian/smarty3@3.1.47-2%2Bdeb12u1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.47-2%252Bdeb12u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/103996?format=json","purl":"pkg:deb/debian/smarty3@3.1.48-2?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.48-2%3Fdistro=trixie"}],"aliases":["CVE-2022-29221","GHSA-634x-pc3q-cf4c"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ke5v-yxmm-fydq"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/smarty3@3.1.45-1%3Fdistro=trixie"}