Improper Neutralization of Special Elements Used in a Template Engine Affecting verbb/formie package, versions >=3.0.0-beta.1, <3.1.27
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-VERBBFORMIE-17824431
- published6 Jul 2026
- disclosed6 Jul 2026
- creditUnknown
Introduced: 6 Jul 2026
NewCVE-2026-52889 (opens in a new tab)How to fix?
Upgrade verbb/formie to version 3.1.27 or higher.
Overview
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the Hidden::getFrontEndInputOptions process. An attacker can execute arbitrary code, access sensitive information, or modify application state by supplying specially crafted input that is evaluated server-side during form rendering. This is only exploitable if a public form contains a Hidden field configured with a request-derived default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value.
Workaround
This vulnerability can be mitigated by avoiding the use of request-derived Hidden field defaults on public forms or by removing affected Hidden fields from public forms until the update is applied.