{"action":"Upgrade lockfile-lint-api to 5.9.2 or later.","affected":[{"fixed":"5.9.2","introduced":"0"}],"component":"lockfile-lint-api","cve_ids":["CVE-2025-4759"],"ecosystem":"npm","epss":0.00439,"exploited":false,"fixed_versions":["5.9.2"],"ghsa_id":"GHSA-7cfr-5cjf-32p4","id":"tcs_01M5KF9M98GGZNRQPEPVX1KVCS","modified_at":"2025-05-16T22:12:11.442481Z","published_at":"2025-05-16T06:30:24Z","references":["https://osv.dev/vulnerability/GHSA-7cfr-5cjf-32p4","https://nvd.nist.gov/vuln/detail/CVE-2025-4759","https://github.com/lirantal/lockfile-lint/pull/204","https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca","https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f","https://github.com/lirantal/lockfile-lint","https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js#L51-L63","https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-7cfr-5cjf-32p4","url":"https://osv.dev/vulnerability/GHSA-7cfr-5cjf-32p4"}],"summary":"lockfile-lint-api Vulnerable to Incorrect Behavior Order"}