{"action":"Upgrade @nfid/embed to 0.10.1-alpha.6 or later.","affected":[{"fixed":"0.10.1-alpha.6","introduced":"0.10.0"}],"component":"@nfid/embed","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.10.1-alpha.6"],"ghsa_id":"GHSA-84c3-j8r2-mcm8","id":"tcs_01M5KFBPGT60TXXWFW5A6NDJ3F","modified_at":"2024-02-26T20:10:10Z","published_at":"2024-02-26T20:10:10Z","references":["https://osv.dev/vulnerability/GHSA-84c3-j8r2-mcm8","https://github.com/dfinity/agent-js/security/advisories/GHSA-c9vv-fhgv-cjc3","https://github.com/internet-identity-labs/sdk-ts/security/advisories/GHSA-84c3-j8r2-mcm8","https://github.com/internet-identity-labs/sdk-ts"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-84c3-j8r2-mcm8","url":"https://osv.dev/vulnerability/GHSA-84c3-j8r2-mcm8"}],"summary":"@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys"}