{"action":"Upgrade manifest to 4.9.2 or later.","affected":[{"fixed":"4.9.2","introduced":"0"}],"component":"manifest","cve_ids":["CVE-2025-27408"],"ecosystem":"npm","epss":0.00158,"exploited":false,"fixed_versions":["4.9.2"],"ghsa_id":"GHSA-h8h6-7752-g28c","id":"tcs_01M5KFTHVM89SF306C61ZPWPP5","modified_at":"2025-03-04T22:23:26Z","published_at":"2025-03-03T19:55:33Z","references":["https://osv.dev/vulnerability/GHSA-h8h6-7752-g28c","https://github.com/mnfst/manifest/security/advisories/GHSA-h8h6-7752-g28c","https://nvd.nist.gov/vuln/detail/CVE-2025-27408","https://github.com/mnfst/manifest/commit/3ed6f1324e96ad469ad929d470dcd0cc386c6c69","https://github.com/mnfst/manifest"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-h8h6-7752-g28c","url":"https://osv.dev/vulnerability/GHSA-h8h6-7752-g28c"}],"summary":"Manifest Uses a One-Way Hash without a Salt"}