{"action":"Upgrade keyget to 2.3.0 or later.","affected":[{"fixed":"2.3.0","introduced":"1.0.0"}],"component":"keyget","cve_ids":["CVE-2020-28272"],"ecosystem":"npm","epss":0.03398,"exploited":false,"fixed_versions":["2.3.0"],"ghsa_id":"GHSA-8mp8-28xh-r486","id":"tcs_01M5KFDGN71MDHS3M8479TPAHT","modified_at":"2023-11-08T04:03:24.648637Z","published_at":"2022-05-24T17:35:13Z","references":["https://osv.dev/vulnerability/GHSA-8mp8-28xh-r486","https://nvd.nist.gov/vuln/detail/CVE-2020-28272","https://github.com/rumkin/keyget/commit/17d15b6c75036eb429075a8cfeccfc18094dd2e2","https://github.com/rumkin/keyget","https://web.archive.org/web/20201207183211/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28272"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-8mp8-28xh-r486","url":"https://osv.dev/vulnerability/GHSA-8mp8-28xh-r486"}],"summary":"keyget vulnerable to prototype pollution"}