{"action":"Upgrade trestle-auth to 0.4.2 or later.","affected":[{"fixed":"0.4.2","introduced":"0.4.0"}],"component":"trestle-auth","cve_ids":["CVE-2021-29435"],"ecosystem":"RubyGems","epss":0.00663,"exploited":false,"fixed_versions":["0.4.2"],"ghsa_id":"GHSA-h8hx-2c5r-32cf","id":"tcs_01M5KEKJDH18MCD51VF97K0FK1","modified_at":"2026-07-08T06:29:41.235308895Z","published_at":"2021-04-13T17:01:50Z","references":["https://osv.dev/vulnerability/GHSA-h8hx-2c5r-32cf","https://github.com/TrestleAdmin/trestle-auth/security/advisories/GHSA-h8hx-2c5r-32cf","https://nvd.nist.gov/vuln/detail/CVE-2021-29435","https://github.com/TrestleAdmin/trestle-auth/commit/cb95b05cdb2609052207af07b4b8dfe3a23c11dc","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/trestle-auth/CVE-2021-29435.yml","https://rubygems.org/gems/trestle-auth"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-h8hx-2c5r-32cf","url":"https://osv.dev/vulnerability/GHSA-h8hx-2c5r-32cf"}],"summary":"Cross-Site Request Forgery (CSRF) in trestle-auth"}