{"action":"Upgrade @editorjs/editorjs to 2.26.0 or later.","affected":[{"fixed":"2.26.0","introduced":"0"}],"component":"@editorjs/editorjs","cve_ids":["CVE-2022-23474"],"ecosystem":"npm","epss":0.00569,"exploited":false,"fixed_versions":["2.26.0"],"ghsa_id":"GHSA-6mvj-2569-3mcm","id":"tcs_01M5KF7HT340TY8H9RDNV8MK5X","modified_at":"2024-08-05T21:41:56.361300Z","published_at":"2024-08-05T21:18:57Z","references":["https://osv.dev/vulnerability/GHSA-6mvj-2569-3mcm","https://nvd.nist.gov/vuln/detail/CVE-2022-23474","https://github.com/codex-team/editor.js/pull/2100","https://github.com/codex-team/editor.js/commit/f659015be6de8e6f0c322c5ff4d1a4532d2f29a2","https://github.com/codex-team/editor.js","https://securitylab.github.com/advisories","https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-6mvj-2569-3mcm","url":"https://osv.dev/vulnerability/GHSA-6mvj-2569-3mcm"}],"summary":"Editor.js vulnerable to Code Injection"}