{"action":"Upgrade gollum to 5.1.2 or later.","affected":[{"fixed":"5.1.2","introduced":"5.0"}],"component":"gollum","cve_ids":["CVE-2020-35305"],"ecosystem":"RubyGems","epss":0.0079,"exploited":false,"fixed_versions":["5.1.2"],"ghsa_id":"GHSA-fj2w-qmjp-3rjm","id":"tcs_01M5KEK2PZZBMJVFJ4E3M1DC37","modified_at":"2024-02-16T08:20:48.053959Z","published_at":"2022-07-16T00:00:28Z","references":["https://osv.dev/vulnerability/GHSA-fj2w-qmjp-3rjm","https://nvd.nist.gov/vuln/detail/CVE-2020-35305","https://github.com/gollum/gollum/commit/137728cdabc0f60859fcd30404ad2b8fff6ef715","https://github.com/Szarny","https://github.com/gollum","https://github.com/gollum/gollum","https://github.com/gollum/gollum/releases/tag/v5.1.2","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/gollum/CVE-2020-35305.yml","http://gollum.com"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-fj2w-qmjp-3rjm","url":"https://osv.dev/vulnerability/GHSA-fj2w-qmjp-3rjm"}],"summary":"Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog"}