{"action":"Upgrade xmlhttprequest-ssl to 1.6.2 or later.","affected":[{"fixed":"1.6.2","introduced":"0"}],"component":"xmlhttprequest-ssl","cve_ids":["CVE-2020-28502"],"ecosystem":"npm","epss":0.04629,"exploited":false,"fixed_versions":["1.6.2"],"ghsa_id":"GHSA-h4j5-c7cj-74xg","id":"tcs_01M5KFT5E5R330QN28NPWRNJM3","modified_at":"2025-01-14T08:57:22.719908Z","published_at":"2021-05-04T18:02:34Z","references":["https://osv.dev/vulnerability/GHSA-h4j5-c7cj-74xg","https://nvd.nist.gov/vuln/detail/CVE-2020-28502","https://github.com/driverdan/node-XMLHttpRequest/commit/983cfc244c7567ad6a59e366e55a8037e0497fe6","https://github.com/mjwwit/node-XMLHttpRequest/commit/ee1e81fc67729c7c0eba5537ed7fe1e30a6b3291","https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js#L480","https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js%23L480","https://github.com/mjwwit/node-XMLHttpRequest/blob/ae38832a0f1347c5e96dda665402509a3458e302/lib/XMLHttpRequest.js#L531","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082937","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082938","https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUEST-1082935","https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1082936"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-h4j5-c7cj-74xg#npm/xmlhttprequest-ssl","url":"https://osv.dev/vulnerability/GHSA-h4j5-c7cj-74xg"}],"summary":"xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection"}