{"action":"Upgrade @rspack/core to 1.0.0-rc.1 or later.","affected":[{"fixed":"1.0.0-rc.1","introduced":"0"}],"component":"@rspack/core","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.0.0-rc.1"],"ghsa_id":"GHSA-84jw-g43v-8gjm","id":"tcs_01M5KFBS682JZZSJANFBMZKRJZ","modified_at":"2024-09-19T17:30:06Z","published_at":"2024-09-19T17:30:05Z","references":["https://osv.dev/vulnerability/GHSA-84jw-g43v-8gjm","https://github.com/web-infra-dev/rspack/security/advisories/GHSA-84jw-g43v-8gjm","https://github.com/web-infra-dev/rspack/commit/0303c68bd76da258c9fd483936d3a00b9761aad0","https://github.com/web-infra-dev/rspack"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-84jw-g43v-8gjm","url":"https://osv.dev/vulnerability/GHSA-84jw-g43v-8gjm"}],"summary":"DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS"}