{"action":"Upgrade kinto-attachment to 6.4.0 or later.","affected":[{"fixed":"6.4.0","introduced":"0"}],"component":"kinto-attachment","cve_ids":["CVE-2024-1314"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["6.4.0"],"ghsa_id":"GHSA-hvp4-vrv2-8wrq","id":"tcs_01M5KFMFS3QQ55FFVB26YJZZ1Y","modified_at":"2026-07-07T17:56:44.775273807Z","published_at":"2024-02-08T18:32:10Z","references":["https://osv.dev/vulnerability/GHSA-hvp4-vrv2-8wrq","https://github.com/Kinto/kinto-attachment/security/advisories/GHSA-hvp4-vrv2-8wrq","https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1","https://bugzilla.mozilla.org/show_bug.cgi?id=1879034","https://github.com/Kinto/kinto-attachment"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-hvp4-vrv2-8wrq","url":"https://osv.dev/vulnerability/GHSA-hvp4-vrv2-8wrq"}],"summary":"Kinto Attachment's attachments can be replaced on read-only records"}