{"action":"Upgrade vp-toolkit to 0.2.2 or later.","affected":[{"fixed":"0.2.2","introduced":"0"}],"component":"vp-toolkit","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.2.2"],"ghsa_id":"GHSA-ff5x-w9wg-h275","id":"tcs_01M5KFN9W5FRYWRS6MSRHDN58R","modified_at":"2020-02-28T16:38:18Z","published_at":"2020-03-06T01:15:46Z","references":["https://osv.dev/vulnerability/GHSA-ff5x-w9wg-h275","https://github.com/rabobank-blockchain/vp-toolkit/security/advisories/GHSA-ff5x-w9wg-h275","https://github.com/rabobank-blockchain/vp-toolkit/issues/14","https://github.com/rabobank-blockchain/vp-toolkit/commit/18a7db84d3265c6ffa10ef63eb37ae1bd4ba192b"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-ff5x-w9wg-h275","url":"https://osv.dev/vulnerability/GHSA-ff5x-w9wg-h275"}],"summary":"Holder can generate proof of ownership for credentials it does not control in vp-toolkit"}