{"action":"Upgrade omniauth to 1.9.2 or later.","affected":[{"fixed":"1.9.2","introduced":"0"},{"fixed":"2.0.0","introduced":"2.0.0.pre.rc1"}],"component":"omniauth","cve_ids":["CVE-2020-36599"],"ecosystem":"RubyGems","epss":0.01163,"exploited":false,"fixed_versions":["1.9.2","2.0.0"],"ghsa_id":"GHSA-pm55-qfxr-h247","id":"tcs_01M5KEMN2XP4273GVHX9F6KY6C","modified_at":"2023-11-08T04:03:48.034548Z","published_at":"2022-08-19T00:00:16Z","references":["https://osv.dev/vulnerability/GHSA-pm55-qfxr-h247","https://nvd.nist.gov/vuln/detail/CVE-2020-36599","https://github.com/omniauth/omniauth/commit/43a396f181ef7d0ed2ec8291c939c95e3ed3ff00#diff-575abda9deb9b1a77bf534e898a923029b9a61e991d626db88dc6e8b34260aa2","https://github.com/omniauth/omniauth","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth/CVE-2020-36599.yml","https://rubygems.org/gems/omniauth/versions/1.9.2"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-pm55-qfxr-h247","url":"https://osv.dev/vulnerability/GHSA-pm55-qfxr-h247"}],"summary":"OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value"}