{"action":"Upgrade vega to 4.5.1 or later.","affected":[{"fixed":"5.4.1","introduced":"5.0.0"},{"fixed":"4.5.1","introduced":"0"}],"component":"vega","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["5.4.1","4.5.1"],"ghsa_id":"GHSA-cp47-r258-q626","id":"tcs_01M5KFK603T1HMQD27Q05QCM72","modified_at":"2023-03-02T23:36:22Z","published_at":"2023-03-02T23:36:22Z","references":["https://osv.dev/vulnerability/GHSA-cp47-r258-q626","https://github.com/vega/vega/security/advisories/GHSA-cp47-r258-q626","https://github.com/vega/vega/pull/1892","https://github.com/vega/vega/commit/692327013eb4dd5adec0c47a620181af1b135e2a","https://github.com/vega/vega","https://github.com/vega/vega/commits/v4.5.1","https://github.com/vega/vega/commits/v5.4.1"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-cp47-r258-q626","url":"https://osv.dev/vulnerability/GHSA-cp47-r258-q626"}],"summary":"Vega vulnerable to arbitrary code execution when clicking href links"}