{"action":"Upgrade gollum to 3.1.1 or later.","affected":[{"fixed":"3.1.1","introduced":"0"}],"component":"gollum","cve_ids":["CVE-2014-9489"],"ecosystem":"RubyGems","epss":0.02941,"exploited":false,"fixed_versions":["3.1.1"],"ghsa_id":"GHSA-q97v-764g-r2rp","id":"tcs_01M5KEMX3T8VM5CNTSBQS9KK6T","modified_at":"2024-02-16T07:59:55.100327Z","published_at":"2017-11-16T01:47:37Z","references":["https://osv.dev/vulnerability/GHSA-q97v-764g-r2rp","https://nvd.nist.gov/vuln/detail/CVE-2014-9489","https://github.com/gollum/gollum/issues/913","https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7","https://github.com/gollum/gollum","https://web.archive.org/web/20200229041306/http://www.securityfocus.com/bid/71499","http://www.openwall.com/lists/oss-security/2015/01/03/19"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-q97v-764g-r2rp","url":"https://osv.dev/vulnerability/GHSA-q97v-764g-r2rp"}],"summary":"gollum and gollum-lib allow remote authenticated users to execute arbitrary code"}