{"action":"Upgrade pickem to 1.0.7 or later.","affected":[{"fixed":"1.0.7","introduced":"0"}],"component":"pickem","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.0.7"],"ghsa_id":"GHSA-8qx3-8gm5-9cj2","id":"tcs_01M5KFDTX18Z7QTH3CN3MBBTR0","modified_at":"2026-08-26T00:42:27.676365494Z","published_at":"2026-08-25T15:59:11Z","references":["https://osv.dev/vulnerability/GHSA-8qx3-8gm5-9cj2","https://github.com/calebogden/pickem-oss/security/advisories/GHSA-8qx3-8gm5-9cj2","https://github.com/calebogden/pickem-oss","https://github.com/calebogden/pickem-oss/releases/tag/v1.0.7"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-8qx3-8gm5-9cj2","url":"https://osv.dev/vulnerability/GHSA-8qx3-8gm5-9cj2"}],"summary":"pickem vulnerable to terminal escape-sequence injection via unsanitized item text"}