{"action":"Upgrade express-xss-sanitizer to 1.1.3 or later.","affected":[{"fixed":"1.1.3","introduced":"0"}],"component":"express-xss-sanitizer","cve_ids":["CVE-2022-21169"],"ecosystem":"npm","epss":0.00954,"exploited":false,"fixed_versions":["1.1.3"],"ghsa_id":"GHSA-grjp-4jmr-mjcw","id":"tcs_01M5KFSE539ZYC0EFY8AAFYP6P","modified_at":"2023-11-08T04:08:04.407342Z","published_at":"2022-09-27T00:00:22Z","references":["https://osv.dev/vulnerability/GHSA-grjp-4jmr-mjcw","https://nvd.nist.gov/vuln/detail/CVE-2022-21169","https://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4","https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39a","https://github.com/AhmedAdelFahim/express-xss-sanitizer","https://runkit.com/embed/w306l6zfm7tu","https://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-grjp-4jmr-mjcw","url":"https://osv.dev/vulnerability/GHSA-grjp-4jmr-mjcw"}],"summary":"express-xss-sanitizer vulnerable to Prototype Pollution via allowedTags attribute"}