VYPR
High severity7.5NVD Advisory· Published Feb 22, 2021· Updated Jun 17, 2026

CVE-2021-26119

CVE-2021-26119

Description

Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
smarty/smartyPackagist
< 3.1.393.1.39

Affected products

6
  • Smarty/Smarty2 versions
    cpe:2.3:a:smarty:smarty:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:smarty:smarty:*:*:*:*:*:*:*:*range: <3.1.39
    • (no CPE)
  • Debian/linux3 versions
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  • ghsa-coords
    Range: < 3.1.39

Patches

Vulnerability mechanics

References

10

News mentions

0

No linked articles in our index yet.