{"action":"Upgrade plist to 3.0.5 or later.","affected":[{"fixed":"3.0.5","introduced":"0"}],"component":"plist","cve_ids":["CVE-2022-22912"],"ecosystem":"npm","epss":0.02553,"exploited":false,"fixed_versions":["3.0.5"],"ghsa_id":"GHSA-4cpg-3vgw-4877","id":"tcs_01M5KF04CNQRE0FS9H6D7SSZY2","modified_at":"2023-11-08T04:08:14.260671Z","published_at":"2022-02-18T00:00:33Z","references":["https://osv.dev/vulnerability/GHSA-4cpg-3vgw-4877","https://nvd.nist.gov/vuln/detail/CVE-2022-22912","https://github.com/TooTallNate/plist.js/issues/114","https://github.com/TooTallNate/plist.js/pull/118","https://github.com/TooTallNate/plist.js/commit/96e2303d059e6be0c9e0c4773226d14b4758de52","https://github.com/TooTallNate/plist.js"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-4cpg-3vgw-4877","url":"https://osv.dev/vulnerability/GHSA-4cpg-3vgw-4877"}],"summary":"Prototype pollution in Plist before 3.0.5 can cause denial of service"}