{"action":"Upgrade privatebin/privatebin to 2.0.5 or later.","affected":[{"fixed":"2.0.5","introduced":"0"}],"component":"privatebin/privatebin","cve_ids":["CVE-2026-55891"],"ecosystem":"Packagist","epss":0.00539,"exploited":false,"fixed_versions":["2.0.5"],"ghsa_id":"GHSA-xrjc-c68j-hp7w","id":"tcs_01M5KFBA6B72QSH16C6FGWQF9C","modified_at":"2026-08-28T20:40:37.666522Z","published_at":"2026-08-28T20:25:34Z","references":["https://osv.dev/vulnerability/GHSA-xrjc-c68j-hp7w","https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-xrjc-c68j-hp7w","https://github.com/PrivateBin/PrivateBin/commit/75f056dcda955d94c17ec5a4f8c54a9b7bfcee07","https://github.com/PrivateBin/PrivateBin","https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5"],"severity":{"label":"unknown","score":0},"sources":[{"source":"osv","source_id":"GHSA-xrjc-c68j-hp7w","url":"https://osv.dev/vulnerability/GHSA-xrjc-c68j-hp7w"}],"summary":"PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI"}