{"action":"Upgrade @sync-in/server to 1.9.3 or later.","affected":[{"fixed":"1.9.3","introduced":"0"}],"component":"@sync-in/server","cve_ids":["CVE-2025-67438"],"ecosystem":"npm","epss":0.00318,"exploited":false,"fixed_versions":["1.9.3"],"ghsa_id":"GHSA-9jmq-xgjm-p8c2","id":"tcs_01M5KFG4KRF6ABGJFBPWVDVP7F","modified_at":"2026-02-20T21:41:26.185984Z","published_at":"2026-02-20T18:31:33Z","references":["https://osv.dev/vulnerability/GHSA-9jmq-xgjm-p8c2","https://nvd.nist.gov/vuln/detail/CVE-2025-67438","https://github.com/Sync-in/server/commit/a6276d067725637310e4e83a3eee337aae81f439","https://gist.github.com/x0root/86db30af91bb0e1707eb7e57a049b6ad","https://github.com/Sync-in/server","https://github.com/Sync-in/server/releases/tag/v1.9.3"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-9jmq-xgjm-p8c2","url":"https://osv.dev/vulnerability/GHSA-9jmq-xgjm-p8c2"},{"source":"nvd","source_id":"CVE-2025-67438","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67438"}],"summary":"Sync-in Server has a stored cross-site scripting (XSS) vulnerability"}