open-dxp/opendxp
Content & Product Management Framework (CMS/PIM)
84%
Total Score
healthy
Healthy, supported by frequent releases and active repository work; workflow pinning needs attention.
Health Score Breakdown
The package runs post-create, post-install, and post-update Composer scripts, which add install-time execution surface and warrant deployment review.
All 10 workflows were analyzed and no untrusted checkout or script-injection paths were found, but all 14 action references are unpinned, including one high-confidence unpinned container image; several reusable workflows also inherit secrets.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-775484 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. open-dxp/opendxp is vulnerable to Insecure Deserialization in versions 1.0.0 - 1.4.1. | 1.0.0 - 1.4.1 | High |
AIKIDO-2026-371604 open-dxp/opendxp is vulnerable to Code Injection in versions 1.0.0 - 1.4.1. | 1.0.0 - 1.4.1 | High |
Package versions
Maintainers
 OpenDXP Team |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 sabre/dav Version ^4.1.2 | — | — |
twig/twig Version ^3.21.1 | — | — |
league/csv Version ^9.11 | — | — |
symfony/uid Version ^7.4 | — | — |
doctrine/orm Version ^2.15 || ^3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 17 days ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.