{"action":"Upgrade convert-svg-core to 0.6.2 or later.","affected":[{"fixed":"0.6.2","introduced":"0"}],"component":"convert-svg-core","cve_ids":["CVE-2022-25759"],"ecosystem":"npm","epss":0.11548,"exploited":false,"fixed_versions":["0.6.2"],"ghsa_id":"GHSA-5gxc-fxcr-9326","id":"tcs_01M5KF3RVNFMY87WCG5ND84DK3","modified_at":"2024-04-22T23:44:03.044105Z","published_at":"2022-07-23T00:00:16Z","references":["https://osv.dev/vulnerability/GHSA-5gxc-fxcr-9326","https://nvd.nist.gov/vuln/detail/CVE-2022-25759","https://github.com/neocotic/convert-svg/issues/81","https://github.com/neocotic/convert-svg/pull/82","https://github.com/neocotic/convert-svg/commit/7e6031ac7427cf82cf312cb4a25040f2e6efe7a5","https://github.com/neocotic/convert-svg","https://security.snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2849633"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-5gxc-fxcr-9326","url":"https://osv.dev/vulnerability/GHSA-5gxc-fxcr-9326"}],"summary":"convert-svg-core vulnerable to remote code injection"}