{"action":"Upgrade nconf to 0.11.4 or later.","affected":[{"fixed":"0.11.4","introduced":"0"}],"component":"nconf","cve_ids":["CVE-2022-21803"],"ecosystem":"npm","epss":0.0178,"exploited":false,"fixed_versions":["0.11.4"],"ghsa_id":"GHSA-6xwr-q98w-rvg7","id":"tcs_01M5KF8C0Z1ZR6XDEGGTYAK3JS","modified_at":"2024-05-19T02:24:17.311015Z","published_at":"2022-04-13T00:00:30Z","references":["https://osv.dev/vulnerability/GHSA-6xwr-q98w-rvg7","https://nvd.nist.gov/vuln/detail/CVE-2022-21803","https://github.com/indexzero/nconf/pull/397","https://github.com/indexzero/nconf","https://github.com/indexzero/nconf/releases/tag/v0.11.4","https://snyk.io/vuln/SNYK-JS-NCONF-2395478"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-6xwr-q98w-rvg7","url":"https://osv.dev/vulnerability/GHSA-6xwr-q98w-rvg7"}],"summary":"Prototype Pollution in nconf"}