{"action":"Upgrade github.com/nezhahq/nezha to 2.0.10 or later.","affected":[{"introduced":"1.14.13","last_affected":"1.14.14"},{"fixed":"2.0.10","introduced":"2.0.0"}],"component":"github.com/nezhahq/nezha","cve_ids":["CVE-2026-62283"],"ecosystem":"Go","epss":0.00551,"exploited":false,"fixed_versions":["2.0.10"],"ghsa_id":"GHSA-q6xx-5vr8-p898","id":"tcs_01M5KFJH1JHVN6RF91QSGP1F97","modified_at":"2026-08-22T11:55:38.642875741Z","published_at":"2026-06-26T22:31:41Z","references":["https://osv.dev/vulnerability/GHSA-q6xx-5vr8-p898","https://github.com/nezhahq/nezha/security/advisories/GHSA-q6xx-5vr8-p898","https://github.com/nezhahq/nezha"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-q6xx-5vr8-p898","url":"https://osv.dev/vulnerability/GHSA-q6xx-5vr8-p898"}],"summary":"Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check"}