Is silverstripe/framework 5.3 vulnerable?

Composer · 24 releases from 5.3.0 to 5.3.23 · latest silverstripe/framework is 6.3.1 · checked 1 Nov 2026

Yes: 1 known advisory

Yes. silverstripe/framework 5.3.23, the last 5.3 release, is affected by 1 known security advisory (1 medium), including CVE-2026-54720. 6 more affect earlier 5.3.x releases. Upgrade to 6.2.2 or later to fix all of them.

Upgrade with:composer require silverstripe/framework:^6.2.2

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting silverstripe/framework 5.3.23

  • MediumCVE-2026-54720GHSA-gvrw-qqp5-jgc527 Aug 2026

    Silverstripe Framework: Possible XSS attack through media embed

    Affected
    <6.2.2
    Fixed in
    6.2.2

Fixed within 5.3.x, affecting earlier releases

  • MediumGHSA-256q-hx8w-xcqx10 Apr 2025

    Silverstripe Framework user enumeration via timing attack on login and password reset forms

    Affected
    >=4.0.0 <5.3.23
    Fixed in
    5.3.23
  • MediumCVE-2025-30148GHSA-rhx4-hvx9-j38710 Apr 2025

    Silverstripe Framework has a XSS vulnerability in HTML editor

    Affected
    <5.3.23
    Fixed in
    5.3.23
  • LowGHSA-74j9-xhqr-6qv323 Jan 2025

    Reflected Cross Site Scripting (XSS) in error message

    Affected
    <5.3.8
    Fixed in
    5.3.8
  • LowGHSA-mqf3-qpc3-g26q14 Jan 2025

    Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message

    Affected
    <5.3.8
    Fixed in
    5.3.8
  • MediumCVE-2024-53277GHSA-ff6q-3c9c-6cf514 Jan 2025

    Silverstripe Framework has a XSS in form messages

    Affected
    <5.3.8
    Fixed in
    5.3.8
  • MediumCVE-2024-47605GHSA-7cmp-cgg8-4c8214 Jan 2025

    Silverstripe Framework has a XSS via insert media remote file oembed

    Affected
    <5.3.8
    Fixed in
    5.3.8

Which of your client projects are still on silverstripe/framework 5.3?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact silverstripe/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other silverstripe/framework versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.