« Volver al listado

CVE-2026-27131

Estado: AplazadaMedia (5.5)—

The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behavior using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Craftcms — Craft CMSAIPutyourlightson — SprigAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-27131",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27131",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-24T14:08:58.187517Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "putyourlightson",
          "product": "craft-sprig",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.15.2"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.15.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-23T20:16:25.240",
  "references": [
    {
      "url": "https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-489"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behavior using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`."
    },
    {
      "lang": "es",
      "value": "El plugin Sprig para Craft CMS es un framework de componentes Twig reactivo para Craft CMS. A partir de la versión 2.0.0 y antes de las versiones 2.15.2 y 3.15.2, los usuarios administradores, y los usuarios con permiso explícito para acceder al Sprig Playground, podrían exponer potencialmente la clave de seguridad, las credenciales y otros datos de configuración sensibles, además de ejecutar la función de firma 'hashData()'. Este problema se mitigó en las versiones 3.15.2 y 2.15.2 al deshabilitar completamente el acceso al Sprig Playground cuando 'devMode' está deshabilitado, por defecto. Es posible anular este comportamiento utilizando una nueva 'enablePlaygroundWhenDevModeDisabled' que por defecto es 'false'."
    }
  ],
  "lastModified": "2026-06-17T10:26:43.367",
  "sourceIdentifier": "security-advisories@github.com"
}