{"action":"Upgrade yayson to 4.3.0 or later.","affected":[{"fixed":"4.3.0","introduced":"0"}],"component":"yayson","cve_ids":["CVE-2026-61534"],"ecosystem":"npm","epss":0.0084,"exploited":false,"fixed_versions":["4.3.0"],"ghsa_id":"GHSA-325j-mg25-8q58","id":"tcs_01M5KEVHJF3S14814FMFDD9Q6Q","modified_at":"2026-09-11T22:15:03.886098994Z","published_at":"2026-09-11T22:11:38Z","references":["https://osv.dev/vulnerability/GHSA-325j-mg25-8q58","https://github.com/confetti/yayson/security/advisories/GHSA-325j-mg25-8q58","https://github.com/confetti/yayson"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-325j-mg25-8q58","url":"https://osv.dev/vulnerability/GHSA-325j-mg25-8q58"}],"summary":"yayson: Prototype pollution in Store/LegacyStore deserialization"}