{"action":"Upgrade pheditor/pheditor to 2.0.4 or later.","affected":[{"fixed":"2.0.4","introduced":"2.0.1"}],"component":"pheditor/pheditor","cve_ids":["CVE-2026-48030"],"ecosystem":"Packagist","epss":0.07548,"exploited":false,"fixed_versions":["2.0.4"],"ghsa_id":"GHSA-jvc5-6g7q-c843","id":"tcs_01M5KF4X00M3KYAW472TKDWNW6","modified_at":"2026-09-10T03:51:08.930086271Z","published_at":"2026-06-09T22:00:35Z","references":["https://osv.dev/vulnerability/GHSA-jvc5-6g7q-c843","https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843","https://github.com/pheditor/pheditor/commit/62b43df7cb8956a9b0deb9bec278ca8676c890c5","https://github.com/pheditor/pheditor"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-jvc5-6g7q-c843","url":"https://osv.dev/vulnerability/GHSA-jvc5-6g7q-c843"}],"summary":"Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter"}