GitHub Advisoryadvisory · Packagist

GHSA-m59h-42jf-cphr Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground

MEDIUM Published 2026-03-23 Modified 2026-03-30 Official page ↗
Aliases
CVE-2026-27131
Ecosystem
Packagist
Packages
putyourlightson/craft-sprig
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-200, CWE-489
Reviewed
2026-03-23

Affected packages

• Packagist putyourlightson/craft-sprig: >= 2.0.0, < 2.15.2 → fixed in 2.15.2 • Packagist putyourlightson/craft-sprig: >= 3.0.0, < 3.7.2 → fixed in 3.7.2

Description

Admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.7.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behaviour using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`. References: • https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475 • https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b

Related

Alias · CVE (1)

  • CVE-2026-27131 The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-489 Active Debug Code weakness

References