{"action":"Upgrade rama to 0.3.0-rc.1 or later.","affected":[{"fixed":"0.3.0-rc.1","introduced":"0"}],"component":"rama","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.3.0-rc.1"],"ghsa_id":"GHSA-cwv4-h3j5-w3cf","id":"tcs_01M5KEX1QYMCHJ1B9AKBVATVWQ","modified_at":"2026-07-07T23:45:17.325937215Z","published_at":"2026-07-07T23:41:12Z","references":["https://osv.dev/vulnerability/GHSA-cwv4-h3j5-w3cf","https://github.com/plabayo/rama/security/advisories/GHSA-cwv4-h3j5-w3cf","https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3","https://github.com/plabayo/rama"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-cwv4-h3j5-w3cf","url":"https://osv.dev/vulnerability/GHSA-cwv4-h3j5-w3cf"}],"summary":"rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path"}