{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.15.0"}],"component":"react-draft-wysiwyg","cve_ids":["CVE-2025-3191"],"ecosystem":"npm","epss":0.00244,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fq5x-7292-2p5r","id":"tcs_01M5KFP139ZNP30QFCNC77TWSC","modified_at":"2025-04-04T18:57:19.206534Z","published_at":"2025-04-04T06:34:22Z","references":["https://osv.dev/vulnerability/GHSA-fq5x-7292-2p5r","https://nvd.nist.gov/vuln/detail/CVE-2025-3191","https://gist.github.com/th4s1s/175ae4b2632096059b42377dd6c49d47","https://github.com/jpuri/react-draft-wysiwyg","https://security.snyk.io/vuln/SNYK-JS-REACTDRAFTWYSIWYG-8515884"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-fq5x-7292-2p5r","url":"https://osv.dev/vulnerability/GHSA-fq5x-7292-2p5r"}],"summary":"React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button"}