{"action":"Upgrade sylius/sylius to 1.9.10 or later.","affected":[{"fixed":"1.9.10","introduced":"0"},{"fixed":"1.10.11","introduced":"1.10.0"},{"fixed":"1.11.2","introduced":"1.11.0"}],"component":"sylius/sylius","cve_ids":["CVE-2022-24749"],"ecosystem":"Packagist","epss":0.01108,"exploited":false,"fixed_versions":["1.9.10","1.10.11","1.11.2"],"ghsa_id":"GHSA-4qrp-27r3-66fj","id":"tcs_01M5KEV7GHA9CKVSDX2XESA1JG","modified_at":"2023-11-08T04:08:35.125122Z","published_at":"2022-03-14T22:38:14Z","references":["https://osv.dev/vulnerability/GHSA-4qrp-27r3-66fj","https://github.com/Sylius/Sylius/security/advisories/GHSA-4qrp-27r3-66fj","https://nvd.nist.gov/vuln/detail/CVE-2022-24749","https://github.com/Sylius/Sylius","https://github.com/Sylius/Sylius/releases/tag/v1.10.11","https://github.com/Sylius/Sylius/releases/tag/v1.11.2","https://github.com/Sylius/Sylius/releases/tag/v1.9.10"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-4qrp-27r3-66fj","url":"https://osv.dev/vulnerability/GHSA-4qrp-27r3-66fj"}],"summary":"Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius"}