{"action":"Upgrade vis-timeline to 7.4.4 or later.","affected":[{"fixed":"7.4.4","introduced":"0"}],"component":"vis-timeline","cve_ids":["CVE-2020-28487"],"ecosystem":"npm","epss":0.01462,"exploited":false,"fixed_versions":["7.4.4"],"ghsa_id":"GHSA-9mrv-456v-pf22","id":"tcs_01M5KFGCAHF35XSDKZN5RRJDG7","modified_at":"2025-01-14T08:56:55.157557Z","published_at":"2021-04-13T15:19:50Z","references":["https://osv.dev/vulnerability/GHSA-9mrv-456v-pf22","https://nvd.nist.gov/vuln/detail/CVE-2020-28487","https://github.com/visjs/vis-timeline/issues/838","https://github.com/visjs/vis-timeline/pull/840","https://github.com/visjs/vis-timeline/commit/a7ca349c7b3b6080efd05776ac77bb27176d4d3f","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501","https://snyk.io/vuln/SNYK-JS-VISTIMELINE-1063500"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-9mrv-456v-pf22","url":"https://osv.dev/vulnerability/GHSA-9mrv-456v-pf22"}],"summary":"Cross-site Scripting in vis-timeline"}