{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.2.6"}],"component":"lutils-merge","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-f7qw-5pvg-mmwp","id":"tcs_01M5KFMWXCWRXTN3VMKZSF9D16","modified_at":"2021-08-16T14:36:47Z","published_at":"2019-06-13T18:58:44Z","references":["https://osv.dev/vulnerability/GHSA-f7qw-5pvg-mmwp","https://github.com/nfour/lutils-merge/issues/1","https://hackerone.com/reports/439107","https://snyk.io/vuln/SNYK-JS-LUTILSMERGE-174783","https://www.npmjs.com/advisories/893"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-f7qw-5pvg-mmwp","url":"https://osv.dev/vulnerability/GHSA-f7qw-5pvg-mmwp"}],"summary":"Prototype Pollution in lutils-merge"}