{"action":"Upgrade github.com/google/cel-go to 0.29.0 or later.","affected":[{"fixed":"0.29.0","introduced":"0.22.0"}],"component":"github.com/google/cel-go","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.29.0"],"ghsa_id":"GHSA-gcjh-h69q-9w9g","id":"tcs_01M5KFAV1D4W7KH032MTJ6AT6R","modified_at":"2026-09-10T03:50:52.106270888Z","published_at":"2026-07-24T16:48:56Z","references":["https://osv.dev/vulnerability/GHSA-gcjh-h69q-9w9g","https://github.com/cel-expr/cel-go/security/advisories/GHSA-gcjh-h69q-9w9g","https://github.com/cel-expr/cel-go"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-gcjh-h69q-9w9g","url":"https://osv.dev/vulnerability/GHSA-gcjh-h69q-9w9g"}],"summary":"cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag"}