{"action":"Upgrade @graphql-mesh/http to 0.3.19 or later.","affected":[{"fixed":"0.3.19","introduced":"0"}],"component":"@graphql-mesh/http","cve_ids":["CVE-2025-27098"],"ecosystem":"npm","epss":0.00364,"exploited":false,"fixed_versions":["0.3.19"],"ghsa_id":"GHSA-j2wh-wrv3-4x4g","id":"tcs_01M5KFWKC9VFDW2YPH411JRHHR","modified_at":"2025-02-20T23:12:14.649413Z","published_at":"2023-02-16T18:41:07Z","references":["https://osv.dev/vulnerability/GHSA-j2wh-wrv3-4x4g","https://github.com/Urigo/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g","https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g","https://nvd.nist.gov/vuln/detail/CVE-2025-27098","https://github.com/Urigo/graphql-mesh/commit/95d93e7c140c2995b37e9d822aa3fe4e24ed2e78","https://github.com/Urigo/graphql-mesh"],"severity":{"label":"medium","score":5.8},"sources":[{"source":"osv","source_id":"GHSA-j2wh-wrv3-4x4g#npm/@graphql-mesh/http","url":"https://osv.dev/vulnerability/GHSA-j2wh-wrv3-4x4g"}],"summary":"Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler"}