knplabs/knp-snappy

Its small runtime dependency set and documented security policy reduce adoption friction. The build workflow leaves all 10 actions unpinned, and no commits were recorded in the last 3 months, so pinning this release is prudent.

Latest v1.7.3

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

No commits or active maintainers were recorded in the last 3 months. The recent registry release partly offsets this, but the short-term source activity lull remains a maintenance caution.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe concern.

Workflow audit

The single workflow was fully analyzed with no injection or high-severity findings, and it does not use broad top-level write permissions. However, all 10 action references are unpinned, leaving the build exposed to reference drift.

Vulnerabilities

Title	Versions	Severity
CVE-2026-46643 KnpLabs/knp-snappy is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 1.7.0.	0.0.0 - 1.7.0	High
CVE-2026-46683 knplabs/knp-snappy is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.0 - 1.6.0.	0.0.0 - 1.6.0	Medium
AIKIDO-2026-10857 knplabs/knp-snappy is vulnerable to Arbitrary File Deletion in versions 0.1.0 - 1.7.1.	0.1.0 - 1.7.1	Low
CVE-2023-41330 knplabs/knp-snappy is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 1.4.2.	0.0.0 - 1.4.2	Critical
CVE-2023-28115 knplabs/knp-snappy is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 1.4.2.	0.0.0 - 1.4.2	Critical