{"action":"Upgrade bagisto/bagisto to 2.3.8 or later.","affected":[{"fixed":"2.3.8","introduced":"0"}],"component":"bagisto/bagisto","cve_ids":["CVE-2025-62417"],"ecosystem":"Packagist","epss":0.00392,"exploited":false,"fixed_versions":["2.3.8"],"ghsa_id":"GHSA-jqrp-58fv-w8cq","id":"tcs_01M5KF4TCS1B0M6SXMVPFZ3VZ7","modified_at":"2025-10-16T21:07:12.705677Z","published_at":"2025-10-16T20:48:11Z","references":["https://osv.dev/vulnerability/GHSA-jqrp-58fv-w8cq","https://github.com/bagisto/bagisto/security/advisories/GHSA-jqrp-58fv-w8cq","https://github.com/bagisto/bagisto/commit/8076c708498a0187bc952d5f5f705e0cb1919682","https://github.com/bagisto/bagisto"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-jqrp-58fv-w8cq","url":"https://osv.dev/vulnerability/GHSA-jqrp-58fv-w8cq"}],"summary":"bagisto has CSV Formula Injection in Create New Product"}