{"action":"No fix published. Pin and monitor.","affected":[],"component":"fiora","cve_ids":["CVE-2025-56514"],"ecosystem":"npm","epss":0.00287,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-hg3j-6pmh-mvjr","id":"tcs_01M5KFV0T3Y063CSAN9KH7BSA3","modified_at":"2025-10-13T15:19:42Z","published_at":"2025-10-01T18:30:38Z","references":["https://osv.dev/vulnerability/GHSA-hg3j-6pmh-mvjr","https://nvd.nist.gov/vuln/detail/CVE-2025-56514","https://fiora.suisuijiang.com","https://github.com/Kov404/CVE-2025-56514/tree/main","https://github.com/yinxin630/fiora"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-hg3j-6pmh-mvjr","url":"https://osv.dev/vulnerability/GHSA-hg3j-6pmh-mvjr"},{"source":"nvd","source_id":"CVE-2025-56514","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56514"}],"summary":"Fiora chat user avatar is vulnerable to XSS via SVG files"}