{"action":"Upgrade symfony/serializer to 2.0.11 or later.","affected":[{"fixed":"2.0.11","introduced":"2.0.0"}],"component":"symfony/serializer","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.0.11"],"ghsa_id":"GHSA-j68w-pg49-f6vx","id":"tcs_01M5KF49W2V0W1993AD68F28WZ","modified_at":"2024-12-04T05:48:43.956460Z","published_at":"2024-05-30T00:52:20Z","references":["https://osv.dev/vulnerability/GHSA-j68w-pg49-f6vx","https://github.com/symfony/serializer/commit/0943a06a663b573d7319fc1acd56d3484eaaa430","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/serializer/2012-02-24.yaml","https://github.com/symfony/serializer","https://symfony.com/blog/security-release-symfony-2-0-11-released"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-j68w-pg49-f6vx","url":"https://osv.dev/vulnerability/GHSA-j68w-pg49-f6vx"}],"summary":"Symfony XML decoding attack vector through external entities"}