bagisto/bagisto (packagist) has 20 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in…
CyberXYZ does not call a package safe in absolute terms. It records 20 known vulnerabilities for bagisto/bagisto (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does bagisto/bagisto have known vulnerabilities?
Yes. CyberXYZ records 20 known vulnerabilities for bagisto/bagisto (packagist), the worst rated CRITICAL. These include GHSA-jqrp-58fv-w8cq, GHSA-5j4h-4f72-qpm6, GHSA-mqhg-v22x-pqj8, GHSA-6h7w-v2xr-mqvw, GHSA-9hvg-qw5q-wqwp.
How do I check bagisto/bagisto before installing?
Search bagisto/bagisto in CyberXYZ Check at https://cyberxyz.io/check?q=bagisto%2Fbagisto. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 13:07 UTC. The most recent advisory here was published 2026-04-21. Updated continuously from NVD, GHSA, OSV and CNA feeds.