{"action":"Upgrade hellojs to 1.18.8 or later.","affected":[{"fixed":"1.18.8","introduced":"0"}],"component":"hellojs","cve_ids":["CVE-2021-26505"],"ecosystem":"npm","epss":0.01144,"exploited":false,"fixed_versions":["1.18.8"],"ghsa_id":"GHSA-g3vf-47fv-8f3c","id":"tcs_01M5KFPYF807762QY2SDAD8GT6","modified_at":"2023-11-08T04:05:21.032993Z","published_at":"2023-08-11T15:30:46Z","references":["https://osv.dev/vulnerability/GHSA-g3vf-47fv-8f3c","https://nvd.nist.gov/vuln/detail/CVE-2021-26505","https://github.com/MrSwitch/hello.js/issues/634","https://github.com/MrSwitch/hello.js/commit/7ab50aeff2d41991f08d4ad6c0481125eea8f6b7","https://github.com/MrSwitch/hello.js"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-g3vf-47fv-8f3c","url":"https://osv.dev/vulnerability/GHSA-g3vf-47fv-8f3c"}],"summary":"MrSwitch hello.js vulnerable to prototype pollution"}