{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.1.39"}],"component":"bun","cve_ids":["CVE-2025-8022"],"ecosystem":"npm","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-4j66-8f4r-3pjx","id":"tcs_01M5KF0Q8J7EMY8EWKWPAWE8YC","modified_at":"2025-07-23T17:42:18.941869Z","published_at":"2025-07-23T06:33:50Z","references":["https://osv.dev/vulnerability/GHSA-4j66-8f4r-3pjx","https://nvd.nist.gov/vuln/detail/CVE-2025-8022","https://gist.github.com/lirantal/9780d664037f29d5277d7b2bc569d213","https://github.com/oven-sh/bun","https://security.snyk.io/vuln/SNYK-JS-BUN-9510752"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-4j66-8f4r-3pjx","url":"https://osv.dev/vulnerability/GHSA-4j66-8f4r-3pjx"}],"summary":"bun vulnerable to OS Command Injection"}