There are 2 open security issues in buster.
2 issues left for the package maintainer to handle:
- CVE-2021-26119:
(needs triaging)
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.
- CVE-2021-26120:
(needs triaging)
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/s/smarty3.png){kind=link}