{"action":"No fix published. Pin and monitor.","affected":[],"component":"fiora","cve_ids":["CVE-2025-56515"],"ecosystem":"npm","epss":0.00516,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-2c6j-vw6r-mfch","id":"tcs_01M5KESR6WQKKCG7BGWD4TBYH0","modified_at":"2025-10-01T21:12:33.510329Z","published_at":"2025-10-01T18:30:38Z","references":["https://osv.dev/vulnerability/GHSA-2c6j-vw6r-mfch","https://nvd.nist.gov/vuln/detail/CVE-2025-56515","https://fiora.suisuijiang.com","https://github.com/Kov404/CVE-2025-56515/tree/main","https://github.com/yinxin630/fiora"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-2c6j-vw6r-mfch","url":"https://osv.dev/vulnerability/GHSA-2c6j-vw6r-mfch"},{"source":"nvd","source_id":"CVE-2025-56515","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56515"}],"summary":"Fiora chat group avatar is vulnerable to XSS via SVG files"}