{"action":"Upgrade pomelo to 2.2.7 or later.","affected":[{"fixed":"2.2.7","introduced":"0"}],"component":"pomelo","cve_ids":["CVE-2019-18954"],"ecosystem":"npm","epss":0.01157,"exploited":false,"fixed_versions":["2.2.7"],"ghsa_id":"GHSA-4x6v-rwh4-55jw","id":"tcs_01M5KF1YHJK5A5NBJWRM56JXTQ","modified_at":"2023-11-08T04:01:26.949414Z","published_at":"2019-12-02T18:16:34Z","references":["https://osv.dev/vulnerability/GHSA-4x6v-rwh4-55jw","https://nvd.nist.gov/vuln/detail/CVE-2019-18954","https://github.com/NetEase/pomelo/issues/1149","https://github.com/cl0udz/vulnerabilities/tree/master/pomelo-critical-state-manipulation"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-4x6v-rwh4-55jw","url":"https://osv.dev/vulnerability/GHSA-4x6v-rwh4-55jw"}],"summary":"Pomelo allows external control of critical state data"}