Cross site scripting vulnerability in Javascript escaping in smarty/smarty
Description
Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
smarty/smartyPackagist | >= 4.0.0, < 4.3.1 | 4.3.1 |
smarty/smartyPackagist | < 3.1.48 | 3.1.48 |
Affected products
2Patches
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
12- github.com/advisories/GHSA-7j98-h7fp-4vwjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-28447ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2023-28447.yamlghsaWEB
- github.com/smarty-php/smarty/commit/685662466f653597428966d75a661073104d713dghsax_refsource_MISCWEB
- github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwjghsax_refsource_CONFIRMWEB
- lists.debian.org/debian-lts-announce/2024/11/msg00013.htmlghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHTghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HPghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP/mitre
News mentions
0No linked articles in our index yet.