HighGHSA-6p78-f7h9-6838CVE-2023-36260

Craft CMS Feed-Me

Published 30 Jan 2024 · Updated 10 Sept 2026

Affected package

Affected: <4.6.2
Fixed in: 4.6.2

Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.6.2

Details

An issue discovered in Craft CMS version 4.6.1.1 allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected.

Is GHSA-6p78-f7h9-6838 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2023-36260
Linkgithub.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28
Linkgithub.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29
Packagegithub.com/craftcms/feed-me
Linkgithub.com/craftcms/feed-me/releases/tag/4.6.2
Linkwww.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.