{"action":"Upgrade roots/soil to 4.1.0 or later.","affected":[{"fixed":"4.1.0","introduced":"0"}],"component":"roots/soil","cve_ids":["CVE-2022-4524"],"ecosystem":"Packagist","epss":0.00591,"exploited":false,"fixed_versions":["4.1.0"],"ghsa_id":"GHSA-jw6x-4h8h-569x","id":"tcs_01M5KF4Y32X4M7MDP2B9V9J6PV","modified_at":"2023-11-08T04:10:51.123573Z","published_at":"2022-12-15T21:30:26Z","references":["https://osv.dev/vulnerability/GHSA-jw6x-4h8h-569x","https://nvd.nist.gov/vuln/detail/CVE-2022-4524","https://github.com/roots/soil/pull/285","https://github.com/roots/soil/commit/0c9151e00ab047da253e5cdbfccb204dd423269d","https://github.com/roots/soil","https://github.com/roots/soil/releases/tag/4.1.0","https://github.com/roots/soil/releases/tag/4.1.1","https://vuldb.com/?id.215904"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-jw6x-4h8h-569x","url":"https://osv.dev/vulnerability/GHSA-jw6x-4h8h-569x"}],"summary":"Roots Soil plugin vulnerable to Cross-site Scripting"}