AIKIDO-2026-750197
craftcms/feed-me is vulnerable to Remote Code Execution (RCE)
75
High Risk
This Affects:
craftcms/feed-meTL;DR
Feed Me parses Twig from fetched feed data when the parseTwig configuration setting is enabled, passing every fetched field value that contains a { character to Craft's renderObjectTemplate(). That call does not enable Craft's Twig sandbox, so untrusted feed content is rendered without sandboxing even when the global Twig sandbox is turned on. A control panel user who runs a feed pointed at an untrusted server can return field values containing a Twig payload that executes code on the server. The fix routes rendering through renderSandboxedObjectTemplate() so feed data is evaluated inside the sandbox.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have enabled the parseTwig configuration setting on a feed that ingests untrusted data.
Background info
craftcms/feed-me is vulnerable to Remote Code Execution (RCE) in versions 6.0.0 - 6.13.0.1.
How to fix this
Upgrade the craftcms/feed-me library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant