{"action":"Upgrade controlled-merge to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"1.0.0"}],"component":"controlled-merge","cve_ids":["CVE-2020-28268"],"ecosystem":"npm","epss":0.0357,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-5pg7-v24c-9rp9","id":"tcs_01M5KF4B45ETVQTV4HWRCABWDY","modified_at":"2023-11-08T04:03:24.404517Z","published_at":"2021-05-18T01:53:46Z","references":["https://osv.dev/vulnerability/GHSA-5pg7-v24c-9rp9","https://nvd.nist.gov/vuln/detail/CVE-2020-28268","https://github.com/hlfshell/controlled-merge/commit/5a4b2e9ffe5a0be7f8843d4ab038599d3ae5f9d4","https://www.npmjs.com/package/controlled-merge","https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28268"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-5pg7-v24c-9rp9","url":"https://osv.dev/vulnerability/GHSA-5pg7-v24c-9rp9"}],"summary":"Prototype pollution in controlled-merge"}