{"action":"Upgrade heroku-addonpool to 0.1.16 or later.","affected":[{"fixed":"0.1.16","introduced":"0"}],"component":"heroku-addonpool","cve_ids":["CVE-2020-7634"],"ecosystem":"npm","epss":0.02787,"exploited":false,"fixed_versions":["0.1.16"],"ghsa_id":"GHSA-3q9x-w53p-jg53","id":"tcs_01M5KEY2518DRXJYTA36GYP4GZ","modified_at":"2026-03-13T22:11:30.333377Z","published_at":"2021-12-09T19:52:03Z","references":["https://osv.dev/vulnerability/GHSA-3q9x-w53p-jg53","https://nvd.nist.gov/vuln/detail/CVE-2020-7634","https://github.com/nodef/heroku-addonpool/commit/b1a5b316473ac92d783f3d54ee048d54082da38d","https://github.com/nodef/heroku-addonpool/blob/master/index.js","https://snyk.io/vuln/SNYK-JS-HEROKUADDONPOOL-564428"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-3q9x-w53p-jg53","url":"https://osv.dev/vulnerability/GHSA-3q9x-w53p-jg53"}],"summary":"OS Command Injection in heroku-addonpool"}