{"action":"Upgrade mapbox.js to 1.6.5 or later.","affected":[{"fixed":"1.6.5","introduced":"0"},{"fixed":"2.1.7","introduced":"2.0.0"}],"component":"mapbox.js","cve_ids":["CVE-2017-1000042"],"ecosystem":"npm","epss":0.00932,"exploited":false,"fixed_versions":["1.6.5","2.1.7"],"ghsa_id":"GHSA-qr28-7j6p-9hmv","id":"tcs_01M5KEN1W2VX45AREQ1XZWRY4F","modified_at":"2023-11-08T03:58:41.962890Z","published_at":"2018-11-09T17:47:45Z","references":["https://osv.dev/vulnerability/GHSA-qr28-7j6p-9hmv","https://nvd.nist.gov/vuln/detail/CVE-2017-1000042","https://hackerone.com/reports/54327","https://github.com/advisories/GHSA-qr28-7j6p-9hmv","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mapbox-rails/CVE-2017-1000042.yml","https://nodesecurity.io/advisories/49","https://www.npmjs.com/advisories/49"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-qr28-7j6p-9hmv","url":"https://osv.dev/vulnerability/GHSA-qr28-7j6p-9hmv"}],"summary":"Content Injection via TileJSON attribute in mapbox.js"}