{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.13.0"}],"component":"tidgi","cve_ids":["CVE-2026-14722"],"ecosystem":"npm","epss":0.00541,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9hc2-hjx8-q6pv","id":"tcs_01M5KFFZ8GCSA97Z57SJ3ZP0RK","modified_at":"2026-07-14T20:00:43.006718488Z","published_at":"2026-07-14T19:52:41Z","references":["https://osv.dev/vulnerability/GHSA-9hc2-hjx8-q6pv","https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv","https://github.com/tiddly-gittly/TidGi-Desktop"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-9hc2-hjx8-q6pv","url":"https://osv.dev/vulnerability/GHSA-9hc2-hjx8-q6pv"}],"summary":"TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution"}