{"action":"Upgrade github.com/Masterminds/vcs to 1.13.2 or later.","affected":[{"fixed":"1.13.2","introduced":"0"}],"component":"github.com/Masterminds/vcs","cve_ids":["CVE-2022-21235"],"ecosystem":"Go","epss":0.01585,"exploited":false,"fixed_versions":["1.13.2"],"ghsa_id":"GHSA-6635-c626-vj4r","id":"tcs_01M5KEZEA8KAARJ651XRTRXFG6","modified_at":"2026-09-10T03:49:28.613761378Z","published_at":"2022-04-01T14:05:33Z","references":["https://osv.dev/vulnerability/GHSA-6635-c626-vj4r","https://github.com/Masterminds/vcs/security/advisories/GHSA-6635-c626-vj4r","https://nvd.nist.gov/vuln/detail/CVE-2022-21235","https://github.com/Masterminds/vcs/pull/105","https://github.com/Masterminds/vcs/commit/922a5122330ea8fbe56352a0172ddb6bf019cd22","https://github.com/Masterminds/vcs","https://github.com/Masterminds/vcs/releases/tag/v1.13.2","https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-6635-c626-vj4r","url":"https://osv.dev/vulnerability/GHSA-6635-c626-vj4r"}],"summary":"Command Injection Vulnerability with Mercurial in VCS"}