smile/elasticsuite

Magento 2 merchandising and search engine built on ElasticSearch

Latest 2.12.2.1

Packagist

78%

Total Score

healthy

Healthy: frequent releases and active repository work outweigh workflow and security-policy gaps.

Are you affected? Scan for Free

Health Score Breakdown

Security policy

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear.

Workflow audit

Seven workflows use pull_request_target alongside untrusted checkouts, creating a meaningful workflow risk; all 35 action references are also unpinned. High-confidence unsound conditions and ad hoc package installs add hygiene concerns, though no script injection was found.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10259 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. smile/elasticsuite is vulnerable to Cross-Site Scripting (XSS) in versions 2.11.0.0 - 2.11.17.0 and 2.0.0.0 - 2.10.32.0.	2.0.0.0 - 2.10.32.02.11.0.0 - 2.11.17.0	High

Package versions

Maintainers

Romain Ruaud

Richard Bayet

Aurélien FOUCRET

Direct Dependencies

Dependency	Last Release	Score
magento/framework Version >=103.0.6	—	—
magento/module-store Version >=101.1.6	—	—
magento/module-backend Version >=102.0.6	—	—
magento/module-catalog Version >=104.0.6	—	—
magento/module-catalog-search Version >=102.0.6	—	—