{"action":"Upgrade gramaddict to 1.2.5 or later.","affected":[{"fixed":"1.2.5","introduced":"0"}],"component":"gramaddict","cve_ids":["CVE-2020-36245"],"ecosystem":"PyPI","epss":0.0152,"exploited":false,"fixed_versions":["1.2.5"],"ghsa_id":"GHSA-q5h6-49gg-2wfg","id":"tcs_01M5KFVCT60S4QQS4CVMRMJBDV","modified_at":"2024-09-20T22:02:39.237520Z","published_at":"2022-05-24T17:42:31Z","references":["https://osv.dev/vulnerability/GHSA-q5h6-49gg-2wfg","https://nvd.nist.gov/vuln/detail/CVE-2020-36245","https://github.com/GramAddict/bot/issues/134","https://github.com/GramAddict/bot/pull/183","https://github.com/GramAddict/bot/commit/b9d11691b2fb13749c3cd0f75c70ee31242053ce","https://github.com/GramAddict/bot","https://github.com/pypa/advisory-database/tree/main/vulns/gramaddict/PYSEC-2021-65.yaml"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-q5h6-49gg-2wfg","url":"https://osv.dev/vulnerability/GHSA-q5h6-49gg-2wfg"}],"summary":"GramAddict bot uses dependency with reverse tcp backdoor"}