{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.1.0"}],"component":"@jsonbored/gittensory-mcp","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-382c-vx95-w3p5","id":"tcs_01M5KEWHAH5HSBX1CTKBN33MBZ","modified_at":"2026-07-09T14:00:37.476741418Z","published_at":"2026-07-09T13:44:51Z","references":["https://osv.dev/vulnerability/GHSA-382c-vx95-w3p5","https://github.com/JSONbored/gittensory/security/advisories/GHSA-382c-vx95-w3p5","https://github.com/JSONbored/gittensory/commit/811ef5fb9d748170011f8854d88c64627ad666a0","https://github.com/JSONbored/gittensory"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-382c-vx95-w3p5","url":"https://osv.dev/vulnerability/GHSA-382c-vx95-w3p5"}],"summary":"Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data"}