| Package | Affected versions | Patched versions |
|---|---|---|
| halo | = 1.1.3= 1.2.0≤ 1.1.1 |
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free