{"action":"Upgrade kuva to 0.3.1 or later.","affected":[{"fixed":"0.3.1","introduced":"0.1.5"},{"fixed":"0.4.1","introduced":"0.4.0"}],"component":"kuva","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.3.1","0.4.1"],"ghsa_id":"GHSA-3c48-9r95-hqhr","id":"tcs_01M5KFCFMDJAGFWBH29H7RCGH9","modified_at":"2026-10-13T14:00:03.541371920Z","published_at":"2026-08-07T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0345","https://crates.io/crates/kuva","https://rustsec.org/advisories/RUSTSEC-2026-0345.html","https://github.com/Psy-Fer/kuva/commit/2b53ceb796bbb0e9bb537836ad19faac53a51852","https://github.com/Psy-Fer/kuva/commit/2219f5931913f79f3b9be47690b8999a3d8b8bfb","https://github.com/Psy-Fer/kuva/commit/76049ff5133dfb796ba759c2c5e486779d3d30c5","https://github.com/Psy-Fer/kuva/releases/tag/v0.4.1","https://github.com/Psy-Fer/kuva/releases/tag/v0.3.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0345","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0345"}],"summary":"Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences"}