{"action":"Upgrade workflow to 4.2.0-beta.64 or later.","affected":[{"fixed":"4.2.0-beta.64","introduced":"0"}],"component":"workflow","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["4.2.0-beta.64"],"ghsa_id":"GHSA-9r75-g2cr-3h76","id":"tcs_01M5KFGSZ0ACS4FAY70KS8ER0M","modified_at":"2026-03-06T19:02:20.219400Z","published_at":"2026-03-06T18:45:02Z","references":["https://osv.dev/vulnerability/GHSA-9r75-g2cr-3h76","https://github.com/vercel/workflow/security/advisories/GHSA-9r75-g2cr-3h76","https://github.com/vercel/workflow/commit/30e24d441e735635ffa4522198e6905d0e51e175","https://github.com/vercel/workflow","https://github.com/vercel/workflow/releases/tag/workflow%404.2.0-beta.64"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-9r75-g2cr-3h76","url":"https://osv.dev/vulnerability/GHSA-9r75-g2cr-3h76"}],"summary":"Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens"}