{"action":"Upgrade github.com/ncarlier/webhookd to 1.22.0 or later.","affected":[{"fixed":"1.22.0","introduced":"0"}],"component":"github.com/ncarlier/webhookd","cve_ids":["CVE-2026-59157"],"ecosystem":"Go","epss":0.00596,"exploited":false,"fixed_versions":["1.22.0"],"ghsa_id":"GHSA-v25g-mvwr-f5fp","id":"tcs_01M5KFNEA3F5DCXKG9BE3AY66N","modified_at":"2026-09-17T17:40:34.657087697Z","published_at":"2026-09-09T23:47:03Z","references":["https://osv.dev/vulnerability/GHSA-v25g-mvwr-f5fp","https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp","https://github.com/ncarlier/webhookd","https://github.com/ncarlier/webhookd/releases/tag/v1.22.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-v25g-mvwr-f5fp","url":"https://osv.dev/vulnerability/GHSA-v25g-mvwr-f5fp"}],"summary":"webhookd: Unrestricted HTTP Header to Shell Variable Injection"}