{"action":"Upgrade npm-lockfile to 2.0.5 or later.","affected":[{"fixed":"2.0.5","introduced":"2.0.3"}],"component":"npm-lockfile","cve_ids":["CVE-2022-0841"],"ecosystem":"npm","epss":0.02513,"exploited":false,"fixed_versions":["2.0.5"],"ghsa_id":"GHSA-cr6m-62pq-hmqh","id":"tcs_01M5KFKG3TMM5KHGX19K2RAPER","modified_at":"2023-11-08T04:07:41.089499Z","published_at":"2022-03-04T00:00:18Z","references":["https://osv.dev/vulnerability/GHSA-cr6m-62pq-hmqh","https://nvd.nist.gov/vuln/detail/CVE-2022-0841","https://github.com/ljharb/npm-lockfile/commit/bfdb84813260f0edbf759f2fde1e8c816c1478b8","https://github.com/ljharb/npm-lockfile","https://huntr.dev/bounties/4f806dc9-2ecd-4e79-997e-5292f1bea9f1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-cr6m-62pq-hmqh","url":"https://osv.dev/vulnerability/GHSA-cr6m-62pq-hmqh"}],"summary":"OS Command injection in npm-lockfile"}