From 7ccf9326c5c60cbe0fed72ad8eb39e037e2f6187 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 29 May 2025 21:03:52 +0000
Subject: [PATCH] Publish Advisories

GHSA-6377-hfv9-hqf6
GHSA-v8wj-f5c7-pvxf
---
 .../2024/11/GHSA-6377-hfv9-hqf6/GHSA-6377-hfv9-hqf6.json  | 8 ++++++--
 .../2025/05/GHSA-v8wj-f5c7-pvxf/GHSA-v8wj-f5c7-pvxf.json  | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/advisories/github-reviewed/2024/11/GHSA-6377-hfv9-hqf6/GHSA-6377-hfv9-hqf6.json b/advisories/github-reviewed/2024/11/GHSA-6377-hfv9-hqf6/GHSA-6377-hfv9-hqf6.json
index e5c93204115..82ae4b4bfe2 100644
--- a/advisories/github-reviewed/2024/11/GHSA-6377-hfv9-hqf6/GHSA-6377-hfv9-hqf6.json
+++ b/advisories/github-reviewed/2024/11/GHSA-6377-hfv9-hqf6/GHSA-6377-hfv9-hqf6.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6377-hfv9-hqf6",
-  "modified": "2024-11-12T19:42:25Z",
+  "modified": "2025-05-29T21:02:01Z",
   "published": "2024-11-06T19:52:31Z",
   "aliases": [
     "CVE-2024-51754"
   ],
   "summary": "Twig has unguarded calls to `__toString()` when nesting an object into an array",
-  "details": "### Description\n\nIn a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance).\n\n### Resolution\n\nThe sandbox mode now checks the `__toString()` method call on all objects.\n\nThe patch for this issue is available [here](https://github.com/twigphp/Twig/commit/cafc608ece310e62a35a76f17e25c04ab9ed05cc) for the 3.11.x branch, and [here](https://github.com/twigphp/Twig/commit/d4a302681bca9f7c6ce2835470d53609cdf3e23e) for the 3.x branch.\n\n### Credits\n\nWe would like to thank Jamie Schouten for reporting the issue and Fabien Potencier for providing the fix.\n",
+  "details": "### Description\n\nIn a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance).\n\n### Resolution\n\nThe sandbox mode now checks the `__toString()` method call on all objects.\n\nThe patch for this issue is available [here](https://github.com/twigphp/Twig/commit/cafc608ece310e62a35a76f17e25c04ab9ed05cc) for the 3.11.x branch, and [here](https://github.com/twigphp/Twig/commit/d4a302681bca9f7c6ce2835470d53609cdf3e23e) for the 3.x branch.\n\n### Credits\n\nWe would like to thank Jamie Schouten for reporting the issue and Fabien Potencier for providing the fix.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -79,6 +79,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/twigphp/Twig"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00039.html"
+    },
     {
       "type": "WEB",
       "url": "https://symfony.com/blog/unguarded-calls-to-__tostring-when-nesting-an-object-into-an-array"
diff --git a/advisories/github-reviewed/2025/05/GHSA-v8wj-f5c7-pvxf/GHSA-v8wj-f5c7-pvxf.json b/advisories/github-reviewed/2025/05/GHSA-v8wj-f5c7-pvxf/GHSA-v8wj-f5c7-pvxf.json
index 12453a9524f..41f8dee40ee 100644
--- a/advisories/github-reviewed/2025/05/GHSA-v8wj-f5c7-pvxf/GHSA-v8wj-f5c7-pvxf.json
+++ b/advisories/github-reviewed/2025/05/GHSA-v8wj-f5c7-pvxf/GHSA-v8wj-f5c7-pvxf.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v8wj-f5c7-pvxf",
-  "modified": "2025-05-27T17:59:52Z",
+  "modified": "2025-05-29T21:03:02Z",
   "published": "2025-05-27T17:59:52Z",
   "aliases": [
     "CVE-2024-52588"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/strapi/strapi/security/advisories/GHSA-v8wj-f5c7-pvxf"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52588"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/strapi/strapi"
@@ -52,6 +56,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2025-05-27T17:59:52Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-05-29T09:15:25Z"
   }
 }
\ No newline at end of file