{"action":"Upgrade putil-merge to 3.8.0 or later.","affected":[{"fixed":"3.8.0","introduced":"0"}],"component":"putil-merge","cve_ids":["CVE-2021-23470"],"ecosystem":"npm","epss":0.01266,"exploited":false,"fixed_versions":["3.8.0"],"ghsa_id":"GHSA-4g77-cvgw-grvw","id":"tcs_01M5KF0AV3Q2QQXVWFGASQD6WV","modified_at":"2026-07-08T06:49:37.509092097Z","published_at":"2022-02-05T00:00:31Z","references":["https://osv.dev/vulnerability/GHSA-4g77-cvgw-grvw","https://nvd.nist.gov/vuln/detail/CVE-2021-23470","https://github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5","https://github.com/panates/putil-merge","https://snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-4g77-cvgw-grvw","url":"https://osv.dev/vulnerability/GHSA-4g77-cvgw-grvw"}],"summary":"Prototype Pollution in putil-merge"}