{"action":"Upgrade ses to 0.13.5 or later.","affected":[{"fixed":"0.13.5","introduced":"0.13.0"},{"fixed":"0.14.5","introduced":"0.14.0"},{"fixed":"0.15.24","introduced":"0.15.0"},{"fixed":"0.16.1","introduced":"0.16.0"},{"fixed":"0.17.1","introduced":"0.17.0"},{"fixed":"0.18.7","introduced":"0.18.0"}],"component":"ses","cve_ids":["CVE-2023-39532"],"ecosystem":"npm","epss":0.01349,"exploited":false,"fixed_versions":["0.13.5","0.14.5","0.15.24","0.16.1","0.17.1","0.18.7"],"ghsa_id":"GHSA-9c4h-3f7h-322r","id":"tcs_01M5KFFFFCPZ2KGB8VQA1HR9TD","modified_at":"2023-11-08T04:13:14.822155Z","published_at":"2023-08-09T14:43:20Z","references":["https://osv.dev/vulnerability/GHSA-9c4h-3f7h-322r","https://github.com/endojs/endo/security/advisories/GHSA-9c4h-3f7h-322r","https://nvd.nist.gov/vuln/detail/CVE-2023-39532","https://github.com/endojs/endo/commit/fc90c6429604dc79ce8e3355e236ccce2bada041","https://github.com/endojs/endo"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-9c4h-3f7h-322r","url":"https://osv.dev/vulnerability/GHSA-9c4h-3f7h-322r"}],"summary":"SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution"}