{"action":"Upgrade json8-merge-patch to 1.0.3 or later.","affected":[{"fixed":"1.0.3","introduced":"0"}],"component":"json8-merge-patch","cve_ids":["CVE-2020-8268"],"ecosystem":"npm","epss":0.01293,"exploited":false,"fixed_versions":["1.0.3"],"ghsa_id":"GHSA-8v9x-9xqg-r8mr","id":"tcs_01M5KFE0ZYJ1DBV19JSN4VAA92","modified_at":"2023-11-08T04:04:16.264418Z","published_at":"2021-05-10T19:17:15Z","references":["https://osv.dev/vulnerability/GHSA-8v9x-9xqg-r8mr","https://nvd.nist.gov/vuln/detail/CVE-2020-8268","https://github.com/sonnyp/JSON8/issues/113","https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e#diff-faa7bef039022bc7ca1c613331b2373950ddd3d65ebf25d1699fbdf89773a387","https://hackerone.com/reports/980649","https://www.npmjs.com/package/json8-merge-patch"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-8v9x-9xqg-r8mr","url":"https://osv.dev/vulnerability/GHSA-8v9x-9xqg-r8mr"}],"summary":"Prototype pollution in json8-merge-patch"}