{"action":"Upgrade hfs to 0.52.10 or later.","affected":[{"fixed":"0.52.10","introduced":"0"}],"component":"hfs","cve_ids":["CVE-2024-39943"],"ecosystem":"npm","epss":0.39474,"exploited":false,"fixed_versions":["0.52.10"],"ghsa_id":"GHSA-5f4x-hwv2-w9w2","id":"tcs_01M5KF3DFT3P97JYVZCKHZ0W4A","modified_at":"2024-11-18T16:26:49Z","published_at":"2024-07-05T00:31:07Z","references":["https://osv.dev/vulnerability/GHSA-5f4x-hwv2-w9w2","https://nvd.nist.gov/vuln/detail/CVE-2024-39943","https://github.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad1d","https://github.com/rejetto/hfs","https://github.com/rejetto/hfs/compare/v0.52.9...v0.52.10","https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-5f4x-hwv2-w9w2","url":"https://osv.dev/vulnerability/GHSA-5f4x-hwv2-w9w2"}],"summary":"rejetto HFS vulnerable to OS Command Execution by remote authenticated users"}