{"action":"Upgrade carrierwave to 2.2.5 or later.","affected":[{"fixed":"3.0.5","introduced":"3.0.0"},{"fixed":"2.2.5","introduced":"0"}],"component":"carrierwave","cve_ids":["CVE-2023-49090"],"ecosystem":"RubyGems","epss":0.00613,"exploited":false,"fixed_versions":["3.0.5","2.2.5"],"ghsa_id":"GHSA-gxhx-g4fq-49hj","id":"tcs_01M5KEKEEDH4ZEBRZSTAZFH9S7","modified_at":"2023-11-29T21:33:27Z","published_at":"2023-11-29T21:33:27Z","references":["https://osv.dev/vulnerability/GHSA-gxhx-g4fq-49hj","https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj","https://nvd.nist.gov/vuln/detail/CVE-2023-49090","https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5","https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3","https://github.com/carrierwaveuploader/carrierwave","https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2023-49090.yml","https://rubygems.org/gems/carrierwave/versions/2.2.5","https://rubygems.org/gems/carrierwave/versions/3.0.5"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-gxhx-g4fq-49hj","url":"https://osv.dev/vulnerability/GHSA-gxhx-g4fq-49hj"}],"summary":"CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS"}