{"action":"Upgrade @saltcorn/server to 1.5.0-beta.19 or later.","affected":[{"fixed":"1.5.0-beta.19","introduced":"1.1.1"}],"component":"@saltcorn/server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.5.0-beta.19"],"ghsa_id":"GHSA-cr3w-cw5w-h3fj","id":"tcs_01M5KFKF39Z8CDVCKAVF0ATWT5","modified_at":"2026-02-03T03:07:43.305257Z","published_at":"2026-01-26T23:34:49Z","references":["https://osv.dev/vulnerability/GHSA-cr3w-cw5w-h3fj","https://github.com/saltcorn/saltcorn/security/advisories/GHSA-cr3w-cw5w-h3fj","https://github.com/saltcorn/saltcorn/commit/1bf681e08c45719a52afcf3506fb5ec59f4974d5","https://github.com/saltcorn/saltcorn","https://github.com/saltcorn/saltcorn/blob/020893c0001678fd5ebd2c088ba68b395de1aabc/packages/saltcorn-admin-models/models/backup.ts#L381-L382","https://github.com/saltcorn/saltcorn/blob/020893c0001678fd5ebd2c088ba68b395de1aabc/packages/server/routes/admin.js#L4886-L4887"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-cr3w-cw5w-h3fj","url":"https://osv.dev/vulnerability/GHSA-cr3w-cw5w-h3fj"}],"summary":"Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE"}