neoan3-apps/template

Version	Released
`v2.1.6` patch	Jan 24, 2023
`v2.1.5` patch	Jan 21, 2023
`v2.1.4` patch	Oct 09, 2022
`v2.1.3` patch	Oct 07, 2022
`v2.1.2` minor	Aug 21, 2022
`2.0.2` patch	Aug 16, 2022
`2.0.1` patch	Aug 15, 2022
`2.0.0` major	Aug 15, 2022
`1.2.0` minor	Mar 11, 2022
`1.1.3` patch	Feb 13, 2022
`1.1.1` patch	Oct 21, 2021
`1.1.0` minor 1 CVE	Jan 10, 2021
`1.0.5` patch 1 CVE	May 08, 2020
`1.0.4` patch 1 CVE	May 07, 2020
`1.0.3` patch 1 CVE	Feb 05, 2020
`1.0.2` patch 1 CVE	Feb 04, 2020
`1.0.1` patch 1 CVE	Feb 04, 2020
`1.0.0` initial 1 CVE	Feb 02, 2020

v2.1.6 patch

Jan 24, 2023

v2.1.5 patch

Jan 21, 2023

v2.1.4 patch

Oct 09, 2022

v2.1.3 patch

Oct 07, 2022

v2.1.2 minor

Aug 21, 2022

2.0.2 patch

Aug 16, 2022

2.0.1 patch

Aug 15, 2022

2.0.0 major

Aug 15, 2022

1.2.0 minor

Mar 11, 2022

1.1.3 patch

Feb 13, 2022

1.1.1 patch

Oct 21, 2021

1.1.0 minor

1 CVE

CVE-2021-41170 GHSA-3v56-q6r6-4gcw Nov 10, 2021

Insecure Inherited Permissions in neoan3-apps/template

7.5 / 10

High

Network Low None None Unchanged None High None

Impact

Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously.

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible.

Patches

Version 1.1.1 has addressed this vulnerability.

$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);

Workarounds

Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

References

As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

For more information

If you have any questions or comments about this advisory:

Open an issue in our repo

Affected versions


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.1.0

Fixed in


          1.1.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jan 10, 2021

1.0.5 patch

1 CVE

CVE-2021-41170 GHSA-3v56-q6r6-4gcw Nov 10, 2021

Insecure Inherited Permissions in neoan3-apps/template

7.5 / 10

High

Network Low None None Unchanged None High None

Impact

Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously.

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible.

Patches

Version 1.1.1 has addressed this vulnerability.

$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);

Workarounds

Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

References

As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

For more information

If you have any questions or comments about this advisory:

Open an issue in our repo

Affected versions


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.1.0

Fixed in


          1.1.1

References

Updated Jul 08, 2026 · Source: OSV.dev

May 08, 2020

1.0.4 patch

1 CVE

CVE-2021-41170 GHSA-3v56-q6r6-4gcw Nov 10, 2021

Insecure Inherited Permissions in neoan3-apps/template

7.5 / 10

High

Network Low None None Unchanged None High None

Impact

Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously.

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible.

Patches

Version 1.1.1 has addressed this vulnerability.

$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);

Workarounds

Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

References

As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

For more information

If you have any questions or comments about this advisory:

Open an issue in our repo

Affected versions


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.1.0

Fixed in


          1.1.1

References

Updated Jul 08, 2026 · Source: OSV.dev

May 07, 2020

1.0.3 patch

1 CVE

CVE-2021-41170 GHSA-3v56-q6r6-4gcw Nov 10, 2021

Insecure Inherited Permissions in neoan3-apps/template

7.5 / 10

High

Network Low None None Unchanged None High None

Impact

Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously.

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible.

Patches

Version 1.1.1 has addressed this vulnerability.

$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);

Workarounds

Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

References

As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

For more information

If you have any questions or comments about this advisory:

Open an issue in our repo

Affected versions


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.1.0

Fixed in


          1.1.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 05, 2020

1.0.2 patch

1 CVE

CVE-2021-41170 GHSA-3v56-q6r6-4gcw Nov 10, 2021

Insecure Inherited Permissions in neoan3-apps/template

7.5 / 10

High

Network Low None None Unchanged None High None

Impact

Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously.

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible.

Patches

Version 1.1.1 has addressed this vulnerability.

$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);

Workarounds

Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

References

As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

For more information

If you have any questions or comments about this advisory:

Open an issue in our repo

Affected versions


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.1.0

Fixed in


          1.1.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 04, 2020

1.0.1 patch

1 CVE

CVE-2021-41170 GHSA-3v56-q6r6-4gcw Nov 10, 2021

Insecure Inherited Permissions in neoan3-apps/template

7.5 / 10

High

Network Low None None Unchanged None High None

Impact

Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously.

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible.

Patches

Version 1.1.1 has addressed this vulnerability.

$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);

Workarounds

Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

References

As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

For more information

If you have any questions or comments about this advisory:

Open an issue in our repo

Affected versions


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.1.0

Fixed in


          1.1.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 04, 2020

1.0.0 initial

1 CVE

CVE-2021-41170 GHSA-3v56-q6r6-4gcw Nov 10, 2021

Insecure Inherited Permissions in neoan3-apps/template

7.5 / 10

High

Network Low None None Unchanged None High None

Impact

Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously.

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible.

Patches

Version 1.1.1 has addressed this vulnerability.

$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);

Workarounds

Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

References

As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

For more information

If you have any questions or comments about this advisory:

Open an issue in our repo

Affected versions


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.1.0

Fixed in


          1.1.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 02, 2020

Activity

Reach

Details