{"action":"Upgrade fava to 1.22.3 or later.","affected":[{"fixed":"1.22.3","introduced":"0"}],"component":"fava","cve_ids":["CVE-2022-2589"],"ecosystem":"PyPI","epss":0.00752,"exploited":false,"fixed_versions":["1.22.3"],"ghsa_id":"GHSA-6hcj-qrw3-m66q","id":"tcs_01M5KF3FSK2H9V3G9JTTCTHXG7","modified_at":"2024-09-20T17:49:16.459741Z","published_at":"2022-08-02T00:00:25Z","references":["https://osv.dev/vulnerability/GHSA-6hcj-qrw3-m66q","https://nvd.nist.gov/vuln/detail/CVE-2022-2589","https://github.com/beancount/fava/commit/68bbb6e39319deb35ab9f18d0b6aa9fa70472539","https://github.com/advisories/GHSA-6hcj-qrw3-m66q","https://github.com/beancount/fava","https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-246.yaml","https://huntr.dev/bounties/8705800d-cf2f-433d-9c3e-dbef6a3f7e08"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-6hcj-qrw3-m66q","url":"https://osv.dev/vulnerability/GHSA-6hcj-qrw3-m66q"}],"summary":"Fava vulnerable to reflected cross-site scripting"}