GHSA-m59h-42jf-cphr

Suggest an improvement
Source
https://github.com/advisories/GHSA-m59h-42jf-cphr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m59h-42jf-cphr/GHSA-m59h-42jf-cphr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m59h-42jf-cphr
Aliases
Published
2026-03-23T20:25:37Z
Modified
2026-03-30T14:07:21Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
Details

Admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the hashData() signing function.

This issue was mitigated in versions 3.7.2 and 2.15.2 by disabling access to the Sprig Playground entirely when devMode is disabled, by default. It is possible to override this behaviour using a new enablePlaygroundWhenDevModeDisabled that defaults to false.

References:

Database specific 
{
    "cwe_ids": [
        "CWE-200",
        "CWE-489"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-23T20:25:37Z",
    "nvd_published_at": "2026-03-23T20:16:25Z",
    "severity": "MODERATE"
}
References

Affected packages

Packagist / putyourlightson/craft-sprig

Package

Name
putyourlightson/craft-sprig
Purl
pkg:composer/putyourlightson/craft-sprig

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.15.2

Affected versions

2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.2.1
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.7.2
2.7.3
2.8.0
2.8.1
2.9.0-beta.1
2.9.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.15.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m59h-42jf-cphr/GHSA-m59h-42jf-cphr.json"

Packagist / putyourlightson/craft-sprig

Package

Name
putyourlightson/craft-sprig
Purl
pkg:composer/putyourlightson/craft-sprig

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.7.2

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.1.0-beta.1
3.1.0
3.2.0
3.2.1
3.3.0
3.4.0
3.5.0
3.5.1
3.5.2
3.6.0
3.6.1
3.7.0
3.7.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m59h-42jf-cphr/GHSA-m59h-42jf-cphr.json"