{"action":"Upgrade engramx to 2.0.2 or later.","affected":[{"fixed":"2.0.2","introduced":"0"}],"component":"engramx","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.0.2"],"ghsa_id":"GHSA-2r2p-4cgf-hv7h","id":"tcs_01M5KETXZ3RG77SQB7HW7YAZG6","modified_at":"2026-04-22T16:33:00.807018Z","published_at":"2026-04-22T14:52:03Z","references":["https://osv.dev/vulnerability/GHSA-2r2p-4cgf-hv7h","https://github.com/NickCirv/engram/security/advisories/GHSA-2r2p-4cgf-hv7h","https://github.com/NickCirv/engram/issues/7","https://github.com/NickCirv/engram"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-2r2p-4cgf-hv7h","url":"https://osv.dev/vulnerability/GHSA-2r2p-4cgf-hv7h"}],"summary":"engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection"}