N00O00B

**Name of the Vulnerable Software and Affected Versions** Grav Flex Objects plugin versions prior to 1.4.0 **Description** A stored server-side template injection exists when rendering dynamic collection or object titles. The plugin passes user-controlled frontmatter values `page.header.flex.collection.title` or `page.header.flex.object.title` to the Twig `template from string()` function, which causes them to be evaluated as Twig code instead of plain text. This process bypasses the `Security::cleanDangerousTwig()` sanitization function. An attacker capable of controlling the title frontmatter of a publicly reachable Flex Objects page can execute arbitrary Twig code and potentially escalate to remote command execution by accessing internal Grav services like the scheduler. **Recommendations** Update Grav Flex Objects plugin to version 1.4.0 or later.