{"action":"Upgrade @tutao/tutanota-utils to 314.251111.0 or later.","affected":[{"fixed":"314.251111.0","introduced":"0"}],"component":"@tutao/tutanota-utils","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["314.251111.0"],"ghsa_id":"GHSA-24v3-254g-jv85","id":"tcs_01M5KERYDKCBKMQHX71WY1EVZD","modified_at":"2025-12-19T21:50:33.801300Z","published_at":"2025-12-19T21:32:35Z","references":["https://osv.dev/vulnerability/GHSA-24v3-254g-jv85","https://github.com/tutao/tutanota/security/advisories/GHSA-24v3-254g-jv85","https://github.com/tutao/tutanota/commit/e28345f5f78f628f9d5c04e785f79543f01dca8b","https://github.com/tutao/tutanota","https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L326","https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L341","https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L356","https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L391","https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L415"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-24v3-254g-jv85","url":"https://osv.dev/vulnerability/GHSA-24v3-254g-jv85"}],"summary":"Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature"}