{"action":"Upgrade @saltcorn/server to 1.0.0-beta.14 or later.","affected":[{"fixed":"1.0.0-beta.14","introduced":"0"}],"component":"@saltcorn/server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.0.0-beta.14"],"ghsa_id":"GHSA-78p3-fwcq-62c2","id":"tcs_01M5KF9AZD29QTGKHP8MJB03ZP","modified_at":"2024-10-03T19:50:59Z","published_at":"2024-10-03T19:50:59Z","references":["https://osv.dev/vulnerability/GHSA-78p3-fwcq-62c2","https://github.com/saltcorn/saltcorn/security/advisories/GHSA-78p3-fwcq-62c2","https://github.com/saltcorn/saltcorn/commit/9e066ae8ba317469053cc27e95dcdf5b6e60e12d","https://github.com/saltcorn/saltcorn","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/infoarch.js#L236-L239"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-78p3-fwcq-62c2","url":"https://osv.dev/vulnerability/GHSA-78p3-fwcq-62c2"}],"summary":"@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings"}