{"action":"Upgrade lazysizes to 5.2.1 or later.","affected":[{"fixed":"5.2.1","introduced":"0"}],"component":"lazysizes","cve_ids":["CVE-2020-7642"],"ecosystem":"npm","epss":0.00889,"exploited":false,"fixed_versions":["5.2.1"],"ghsa_id":"GHSA-hg2p-2cvq-4ppv","id":"tcs_01M5KFV04V04DYN2ST8HW55FDS","modified_at":"2026-07-08T06:49:35.784231806Z","published_at":"2021-12-10T20:06:23Z","references":["https://osv.dev/vulnerability/GHSA-hg2p-2cvq-4ppv","https://nvd.nist.gov/vuln/detail/CVE-2020-7642","https://github.com/aFarkas/lazysizes/commit/3720ab8262552d4e063a38d8492f9490a231fd48","https://snyk.io/vuln/SNYK-JS-LAZYSIZES-567144"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-hg2p-2cvq-4ppv","url":"https://osv.dev/vulnerability/GHSA-hg2p-2cvq-4ppv"}],"summary":"Cross-site scripting in lazysizes"}