{"action":"Upgrade keystone to 4.0.0-beta7 or later.","affected":[{"fixed":"4.0.0-beta7","introduced":"0"}],"component":"keystone","cve_ids":["CVE-2017-15879"],"ecosystem":"npm","epss":0.07217,"exploited":false,"fixed_versions":["4.0.0-beta7"],"ghsa_id":"GHSA-6494-v9fq-fgq2","id":"tcs_01M5KF5J1JAGZ6A3G7828FBZBW","modified_at":"2023-11-08T03:58:58.914621Z","published_at":"2017-11-16T01:46:50Z","references":["https://osv.dev/vulnerability/GHSA-6494-v9fq-fgq2","https://nvd.nist.gov/vuln/detail/CVE-2017-15879","https://github.com/keystonejs/keystone/pull/4478","https://github.com/advisories/GHSA-6494-v9fq-fgq2","https://packetstormsecurity.com/files/144755/KeystoneJS-4.0.0-beta.5-Unauthenticated-CSV-Injection.html","https://www.exploit-db.com/exploits/43053"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-6494-v9fq-fgq2","url":"https://osv.dev/vulnerability/GHSA-6494-v9fq-fgq2"}],"summary":"Keystone is vulnerable to CSV injection"}