How severe is GHSA-39j2-4p9j-5w4j?

No CVSS score has been assigned to GHSA-39j2-4p9j-5w4j yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-39j2-4p9j-5w4j?

GHSA-39j2-4p9j-5w4j affects the following packages: ezsystems/ezpublish-legacy (Packagist), ezsystems/ezpublish-legacy (Packagist), ezsystems/ezpublish-legacy (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-39j2-4p9j-5w4j?

Update ezsystems/ezpublish-legacy to 2019.3.5.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-39j2-4p9j-5w4j is resolved across your whole dependency graph.

How do I detect GHSA-39j2-4p9j-5w4j in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ezsystems/ezpublish-legacy, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-39j2-4p9j-5w4j if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-39j2-4p9j-5w4j actively exploited in the wild?

No public exploit code has been indexed for GHSA-39j2-4p9j-5w4j yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-39j2-4p9j-5w4j published, and has it been updated?

GHSA-39j2-4p9j-5w4j was published on May 15, 2024 and was last updated on November 29, 2024. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

Ez Platform Object Injection in legacy shop module

Real-World Exposure

3 pkgs affected

🐘ezsystems/ezpublish-legacy🐘ezsystems/ezpublish-legacy🐘ezsystems/ezpublish-legacy

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`ezsystems/ezpublish-legacy`	≥ 2019.3.0&&< 2019.3.5.1	2019.3.5.1`composer require ezsystems/ezpublish-legacy:^2019.3.5.1`
🐘Packagist	`ezsystems/ezpublish-legacy`	≥ 2017.12.0&&< 2017.12.7.3	2017.12.7.3`composer require ezsystems/ezpublish-legacy:^2017.12.7.3`
🐘Packagist	`ezsystems/ezpublish-legacy`	≥ 5.4.0&&< 5.4.14.2	5.4.14.2`composer require ezsystems/ezpublish-legacy:^5.4.14.2`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ezsystems/ezpublish-legacy, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update ezsystems/ezpublish-legacy to 2019.3.5.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-39j2-4p9j-5w4j is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.

O3 Security · Impact-Aware SCA

Is GHSA-39j2-4p9j-5w4j in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works

Ez Platform Object Injection in legacy shop moduleGHSA-39j2-4p9j-5w4j