{"action":"Upgrade hashi-vault-js to 0.5.2 or later.","affected":[{"fixed":"0.5.2","introduced":"0"}],"component":"hashi-vault-js","cve_ids":["CVE-2026-55100"],"ecosystem":"npm","epss":0.0056,"exploited":false,"fixed_versions":["0.5.2"],"ghsa_id":"GHSA-g956-2f74-rmv7","id":"tcs_01M5KFR4G464FMM83XRGS6YYX8","modified_at":"2026-07-31T17:26:45.310806Z","published_at":"2026-07-31T17:03:27Z","references":["https://osv.dev/vulnerability/GHSA-g956-2f74-rmv7","https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7","https://github.com/kyndryl-open-source/hashi-vault-js/pull/66","https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2","https://github.com/kyndryl-open-source/hashi-vault-js","https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-g956-2f74-rmv7","url":"https://osv.dev/vulnerability/GHSA-g956-2f74-rmv7"}],"summary":"hashi-vault-js has a path traversal and query parameter injection"}