{"action":"Upgrade @openzeppelin/contracts-upgradeable to 4.9.3 or later.","affected":[{"fixed":"4.9.3","introduced":"4.0.0"}],"component":"@openzeppelin/contracts-upgradeable","cve_ids":["CVE-2023-40014"],"ecosystem":"npm","epss":0.00743,"exploited":false,"fixed_versions":["4.9.3"],"ghsa_id":"GHSA-g4vp-m682-qqmp","id":"tcs_01M5KFQ2C14G3V9C0KXRTGSDRV","modified_at":"2023-11-08T04:13:16.291927Z","published_at":"2023-08-11T19:00:48Z","references":["https://osv.dev/vulnerability/GHSA-g4vp-m682-qqmp","https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmp","https://nvd.nist.gov/vuln/detail/CVE-2023-40014","https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481","https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484","https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd","https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5","https://github.com/OpenZeppelin/openzeppelin-contracts","https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v4.9.3/CHANGELOG.md","https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-g4vp-m682-qqmp#npm/@openzeppelin/contracts-upgradeable","url":"https://osv.dev/vulnerability/GHSA-g4vp-m682-qqmp"}],"summary":"OpenZeppelin Contracts vulnerable to Improper Escaping of Output"}