{"action":"Upgrade @graphql-mesh/cli to 0.82.22 or later.","affected":[{"fixed":"0.82.22","introduced":"0.78.0"}],"component":"@graphql-mesh/cli","cve_ids":["CVE-2025-27098"],"ecosystem":"npm","epss":0.00364,"exploited":false,"fixed_versions":["0.82.22"],"ghsa_id":"GHSA-j2wh-wrv3-4x4g","id":"tcs_01M5KFWK4YD9QN611KT1QVGJ4D","modified_at":"2025-02-20T23:12:14.649413Z","published_at":"2023-02-16T18:41:07Z","references":["https://osv.dev/vulnerability/GHSA-j2wh-wrv3-4x4g","https://github.com/Urigo/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g","https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g","https://nvd.nist.gov/vuln/detail/CVE-2025-27098","https://github.com/Urigo/graphql-mesh/commit/95d93e7c140c2995b37e9d822aa3fe4e24ed2e78","https://github.com/Urigo/graphql-mesh"],"severity":{"label":"medium","score":5.8},"sources":[{"source":"osv","source_id":"GHSA-j2wh-wrv3-4x4g","url":"https://osv.dev/vulnerability/GHSA-j2wh-wrv3-4x4g"}],"summary":"Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler"}