{"action":"Upgrade xmlhttprequest to 1.7.0 or later.","affected":[{"fixed":"1.7.0","introduced":"0"}],"component":"xmlhttprequest","cve_ids":["CVE-2020-28502"],"ecosystem":"npm","epss":0.04629,"exploited":false,"fixed_versions":["1.7.0"],"ghsa_id":"GHSA-h4j5-c7cj-74xg","id":"tcs_01M5KFT57YCQ21PV6T1984WMPV","modified_at":"2025-01-14T08:57:22.719908Z","published_at":"2021-05-04T18:02:34Z","references":["https://osv.dev/vulnerability/GHSA-h4j5-c7cj-74xg","https://nvd.nist.gov/vuln/detail/CVE-2020-28502","https://github.com/driverdan/node-XMLHttpRequest/commit/983cfc244c7567ad6a59e366e55a8037e0497fe6","https://github.com/mjwwit/node-XMLHttpRequest/commit/ee1e81fc67729c7c0eba5537ed7fe1e30a6b3291","https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js#L480","https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js%23L480","https://github.com/mjwwit/node-XMLHttpRequest/blob/ae38832a0f1347c5e96dda665402509a3458e302/lib/XMLHttpRequest.js#L531","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082937","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082938","https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUEST-1082935","https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1082936"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-h4j5-c7cj-74xg","url":"https://osv.dev/vulnerability/GHSA-h4j5-c7cj-74xg"}],"summary":"xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection"}