{"action":"Upgrade pocketmine/pocketmine-mp to 4.8.1 or later.","affected":[{"fixed":"4.8.1","introduced":"0"}],"component":"pocketmine/pocketmine-mp","cve_ids":["CVE-2023-54396"],"ecosystem":"Packagist","epss":0.00376,"exploited":false,"fixed_versions":["4.8.1"],"ghsa_id":"GHSA-wqqv-jcfr-9f5g","id":"tcs_01M5KFAABAT2K7AQ356ESJYDD3","modified_at":"2026-09-10T03:56:11.389995063Z","published_at":"2023-01-09T20:07:27Z","references":["https://osv.dev/vulnerability/GHSA-wqqv-jcfr-9f5g","https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g","https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb","https://github.com/pmmp/PocketMine-MP","https://github.com/pmmp/PocketMine-MP/blob/38d6284671e8b657ba557e765a6c29b24a7705f5/src/item/Banner.php#L104"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-wqqv-jcfr-9f5g","url":"https://osv.dev/vulnerability/GHSA-wqqv-jcfr-9f5g"}],"summary":"PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash"}