[CRITICAL] Formie Hidden field defaults vulnerable to Server-Side Template Injection

PKSA-rm1g-8q6b-7djk CVE-2026-52889 GHSA-565m-g33j-jq96

Affected package: verbb/formie

Affected version: <3.1.27

Reported by:
GitHub