craftcms/feed-me

Healthy and suitable to depend on. It has a long, active release history, ongoing commits from two contributors, organization backing, tests and changelog documentation, and no deprecation or workflow red flags; only limited security automation and incomplete workflow permission declarations warrant attention.

Latest 6.15.2

Packagist

88%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing automated security checks are a transparency and process gap, though other repository evidence shows active maintenance.

Token permissions

No workflow declares top-level permissions in 2 of 3 workflows, although none declares top-level write access and one is explicitly read-only. This is a modest workflow-hardening gap, not a severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-270050 craftcms/feed-me is vulnerable to Server-Side Request Forgery (SSRF) in versions 6.0.0 - 6.13.0.1.	6.0.0 - 6.13.0.1	High
AIKIDO-2026-750197 craftcms/feed-me is vulnerable to Remote Code Execution (RCE) in versions 6.0.0 - 6.13.0.1.	6.0.0 - 6.13.0.1	High
AIKIDO-2024-10377 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. craftcms/feed-me is vulnerable to Insertion of Sensitive Information into Log File in versions 6.2.0 - 6.2.1.	6.2.0 - 6.2.1	Low

Package versions

Maintainers

Pixel & Tonic

Verbb

Direct Dependencies

Dependency	Last Release	Score
league/csv Version ^9.0	—	—
craftcms/cms Version ^5.10.9	—	—
nesbot/carbon Version ^2.10\|^3.0.0	—	—
seld/jsonlint Version ^1.7	—	—
cakephp/utility Version ^5.0.0	—	—