yiisoft/yii2

Healthy and suitable to depend on. It has a long release history, a stable current version, recent commits from six contributors, and clear licensing and security reporting. The repository lacks automated security-scanning tools, but the project is active and not archived or deprecated.

Latest 2.0.55

Packagist

88%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

100

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. This is a transparency and preventive-maintenance gap, though it is outweighed by the active repository and separate security policy.

Vulnerabilities

Title	Versions	Severity
CVE-2026-39850 yiisoft/yii2 is vulnerable to Improper Input Validation in versions 0.0.0 - 2.0.55.	0.0.0 - 2.0.55	High
CVE-2024-58136 yiisoft/yii2 is vulnerable to Improper Protection of Alternate Path in versions 0.0.0 - 2.0.52.	0.0.0 - 2.0.52	Critical
CVE-2024-4990 yiisoft/yii2 is vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in versions 0.0.0 - 2.0.49.4.	0.0.0 - 2.0.49.4	High
CVE-2024-32877 yiisoft/yii2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 2.0.43 - 2.0.49.4.	2.0.43 - 2.0.49.4	Medium
CVE-2015-5467 yiisoft/yii2 is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 2.0.0 - 2.0.5.	2.0.0 - 2.0.5	Critical

Package versions

Maintainers

Qiang Xue

Alexander Makarov

Maurizio Domba

Carsten Brandt

Timur Ruziev

Paul Klimov

Dmitry Naumenko

Boudewijn Vahrmeijer

Direct Dependencies

Dependency	Last Release	Score
cebe/markdown Version ~1.0.0 \| ~1.1.0 \| ~1.2.0	—	—
bower-asset/jquery Version 3.7.@stable \| 3.6.@stable \| 3.5.@stable \| 3.4.@stable \| 3.3.@stable \| 3.2.@stable \| 3.1.@stable \| 2.2.@stable \| 2.1.@stable \| 1.11.@stable \| 1.12.*@stable	—	—
ezyang/htmlpurifier Version ^4.17	—	—
bower-asset/punycode Version ^2.2	—	—
bower-asset/inputmask Version ^5.0.8	—	—