{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.0.0"}],"component":"create-choo-electron","cve_ids":["CVE-2022-25908"],"ecosystem":"npm","epss":0.01547,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-j8wr-fwf2-vvr9","id":"tcs_01M5KFXF4KE33500G2DQ6A6QCD","modified_at":"2025-04-01T23:03:04Z","published_at":"2023-01-26T21:30:25Z","references":["https://osv.dev/vulnerability/GHSA-j8wr-fwf2-vvr9","https://nvd.nist.gov/vuln/detail/CVE-2022-25908","https://security.snyk.io/vuln/SNYK-JS-CREATECHOOELECTRON-3157953"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-j8wr-fwf2-vvr9","url":"https://osv.dev/vulnerability/GHSA-j8wr-fwf2-vvr9"}],"summary":"Command Injection in create-choo-electron"}