{"action":"Upgrade vanilla/safecurl to 0.9.2 or later.","affected":[{"fixed":"0.9.2","introduced":"0"}],"component":"vanilla/safecurl","cve_ids":["CVE-2020-36474"],"ecosystem":"Packagist","epss":0.01804,"exploited":false,"fixed_versions":["0.9.2"],"ghsa_id":"GHSA-x2xg-6wcj-6xf9","id":"tcs_01M5KFAJRP7N94SG3E1980VD8T","modified_at":"2024-12-02T05:43:03.381358Z","published_at":"2021-08-25T14:49:48Z","references":["https://osv.dev/vulnerability/GHSA-x2xg-6wcj-6xf9","https://nvd.nist.gov/vuln/detail/CVE-2020-36474","https://github.com/vanilla/safecurl/pull/2","https://github.com/vanilla/safecurl","https://github.com/vanilla/safecurl/releases/tag/v0.9.2"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-x2xg-6wcj-6xf9","url":"https://osv.dev/vulnerability/GHSA-x2xg-6wcj-6xf9"}],"summary":"SafeCurl before 0.9.2 has a DNS rebinding vulnerability."}