{"action":"Upgrade putil-merge to 3.7.0 or later.","affected":[{"fixed":"3.7.0","introduced":"1.0.0"}],"component":"putil-merge","cve_ids":["CVE-2021-25953"],"ecosystem":"npm","epss":0.02961,"exploited":false,"fixed_versions":["3.7.0"],"ghsa_id":"GHSA-9x7m-9hpg-xxmw","id":"tcs_01M5KFH9K06WCW4VFEA0QYMKWX","modified_at":"2023-11-08T04:05:18.445998Z","published_at":"2021-12-10T17:24:16Z","references":["https://osv.dev/vulnerability/GHSA-9x7m-9hpg-xxmw","https://nvd.nist.gov/vuln/detail/CVE-2021-25953","https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25953"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-9x7m-9hpg-xxmw","url":"https://osv.dev/vulnerability/GHSA-9x7m-9hpg-xxmw"}],"summary":"Prototype Pollution in putil-merge"}