Likely permanent: GitHub doesn’t review this ecosystem
GHSA-vcvr-2r7j-p76h
formcreator on other · published in pluginsglpi/formcreator
Facts
- Severity
- High · CVSS score 7.3CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Affected versions (formcreator)
- 2.9As entered by the maintainer. Not reviewed.
- Fixed in (formcreator)
- not stated
- Affected versions (formcreator)
- 2.10As entered by the maintainer. Not reviewed.
- Fixed in (formcreator)
- not stated
- Affected versions (formcreator)
- 2.11As entered by the maintainer. Not reviewed.
- Fixed in (formcreator)
- not stated
- Affected versions (formcreator)
- 2.12As entered by the maintainer. Not reviewed.
- Fixed in (formcreator)
- not stated
- Affected versions (formcreator)
- 2.13As entered by the maintainer. Not reviewed.
- Fixed in (formcreator)
- 2.13.11
- CVE
- CVE-2026-46422 · reserved, record not publishedThe ID is public but empty: looking it up returns nothing. The CVE Program expects publication within 72 hours.
- GitHub Advisory Database
- Not reviewed
- OSV.dev
- Not present
- Other CVEs pointing here
- None found in the CVE List
If you use formcreator 2.9
No fixed version is listed yet. Check the advisory for workarounds. Dependabot, npm audit and OSV-Scanner probably never will.
Timeline
2026-07-24 05:40 UTC
Published by the maintainers
Cites CVE-2026-46422
2026-10-31 12:46 UTC
First seen by Limbowatch
CVE still reserved · not reviewed · not in OSV
Waiting
CVE record published
Not expected
Reviewed by GitHub
GitHub doesn’t review this ecosystem
Machine-readable record: feed/GHSA-vcvr-2r7j-p76h.json