VulnerableCode Package Details - pkg:gem/spree@4.2.1

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:gem/spree@4.2.1

purl	pkg:gem/spree@4.2.1

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	3.1

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-tkvr-997w-7qe7 Aliases: GHSA-xf4v-w5x5-pv79	Spree: CSV Formula Injection in Customer Export	5.2.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.3.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.4.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-tkvr-997w-7qe7
Aliases:
GHSA-xf4v-w5x5-pv79

Spree: CSV Formula Injection in Customer Export

5.2.8
Affected by 1 other vulnerability.

5.3.6
Affected by 1 other vulnerability.

5.4.3
Affected by 1 other vulnerability.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-13T09:29:10.192046+00:00	Ruby Importer	Affected by	VCID-tkvr-997w-7qe7	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/GHSA-xf4v-w5x5-pv79.yml	38.6.0