{"action":"Upgrade plotly.js to 1.16.0 or later.","affected":[{"fixed":"1.16.0","introduced":"0"}],"component":"plotly.js","cve_ids":["CVE-2017-1000006"],"ecosystem":"npm","epss":0.00878,"exploited":false,"fixed_versions":["1.16.0"],"ghsa_id":"GHSA-2fqv-h3r5-m4vf","id":"tcs_01M5KESYVQ3NSY1Y99EMDZ7JQP","modified_at":"2023-11-08T03:58:41.472015Z","published_at":"2017-10-24T18:33:35Z","references":["https://osv.dev/vulnerability/GHSA-2fqv-h3r5-m4vf","https://nvd.nist.gov/vuln/detail/CVE-2017-1000006","https://acloudtree.com/2016-08-09-how-i-hacked-plotly-by-exploiting-a-svg-vulnerability-in-plotlyjs","https://github.com/advisories/GHSA-2fqv-h3r5-m4vf","https://www.npmjs.com/advisories/145","http://help.plot.ly/security-advisories/2016-08-08-plotlyjs-xss-advisory"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-2fqv-h3r5-m4vf","url":"https://osv.dev/vulnerability/GHSA-2fqv-h3r5-m4vf"}],"summary":"Cross Site Scripting (XSS) in plotly.js"}