{"action":"Upgrade vega-util to 1.13.1 or later.","affected":[{"fixed":"1.13.1","introduced":"0"}],"component":"vega-util","cve_ids":["CVE-2019-10806"],"ecosystem":"npm","epss":0.01109,"exploited":false,"fixed_versions":["1.13.1"],"ghsa_id":"GHSA-6hwh-rqwf-cxxr","id":"tcs_01M5KF78DRQ13VPH8KG54HCGZ6","modified_at":"2026-07-08T05:56:33.518860083Z","published_at":"2021-05-07T16:32:02Z","references":["https://osv.dev/vulnerability/GHSA-6hwh-rqwf-cxxr","https://nvd.nist.gov/vuln/detail/CVE-2019-10806","https://github.com/vega/vega/commit/8f33a0b5170d7de4f12fc248ec0901234342367b","https://snyk.io/vuln/SNYK-JS-VEGAUTIL-559223"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-6hwh-rqwf-cxxr","url":"https://osv.dev/vulnerability/GHSA-6hwh-rqwf-cxxr"}],"summary":"Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util"}