{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.0.12"}],"component":"npm-programmatic","cve_ids":["CVE-2020-7614"],"ecosystem":"npm","epss":0.03604,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-426h-24vj-qwxf","id":"tcs_01M5KEYSGW9YFMCES2XYDK2B4A","modified_at":"2026-03-13T22:11:35.047943Z","published_at":"2020-04-23T20:09:09Z","references":["https://osv.dev/vulnerability/GHSA-426h-24vj-qwxf","https://nvd.nist.gov/vuln/detail/CVE-2020-7614","https://github.com/Manak/npm-programmatic/blob/master/index.js#L18","https://snyk.io/vuln/SNYK-JS-NPMPROGRAMMATIC-564115","https://www.npmjs.com/advisories/1507"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-426h-24vj-qwxf","url":"https://osv.dev/vulnerability/GHSA-426h-24vj-qwxf"}],"summary":"Command Injection in npm-programmatic"}