{"action":"Upgrade gollum-lib to 4.0.1 or later.","affected":[{"fixed":"4.0.1","introduced":"0"}],"component":"gollum-lib","cve_ids":["CVE-2014-9489"],"ecosystem":"RubyGems","epss":0.02941,"exploited":false,"fixed_versions":["4.0.1"],"ghsa_id":"GHSA-q97v-764g-r2rp","id":"tcs_01M5KEMX9TSQGN2D2VGZ085YCT","modified_at":"2024-02-16T07:59:55.100327Z","published_at":"2017-11-16T01:47:37Z","references":["https://osv.dev/vulnerability/GHSA-q97v-764g-r2rp","https://nvd.nist.gov/vuln/detail/CVE-2014-9489","https://github.com/gollum/gollum/issues/913","https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7","https://github.com/gollum/gollum","https://web.archive.org/web/20200229041306/http://www.securityfocus.com/bid/71499","http://www.openwall.com/lists/oss-security/2015/01/03/19"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-q97v-764g-r2rp#RubyGems/gollum-lib","url":"https://osv.dev/vulnerability/GHSA-q97v-764g-r2rp"}],"summary":"gollum and gollum-lib allow remote authenticated users to execute arbitrary code"}