CVE-2026-27131

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27131
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27131.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27131
Aliases
Published
2026-03-23T19:04:37.417Z
Modified
2026-04-10T05:38:17.470365Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
Details

The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the hashData() signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when devMode is disabled, by default. It is possible to override this behavior using a new enablePlaygroundWhenDevModeDisabled that defaults to false.

Database specific 
{
    "cwe_ids": [
        "CWE-200",
        "CWE-489"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27131.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/putyourlightson/craft-sprig

Affected ranges

Type
GIT
Repo
https://github.com/putyourlightson/craft-sprig
Events
Introduced
1a4be65faedbdbfaf9aa6e77287b8cd5600c5eba
Fixed
e1d9986c5e529714c7e0a6d0c3c2502e4da97c7e
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.15.2"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27131.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "3.0.0"
            },
            {
                "fixed": "3.15.2"
            }
        ]
    }
]