{"action":"Upgrade @insumermodel/mppx-token-gate to 1.0.4 or later.","affected":[{"fixed":"1.0.4","introduced":"0"}],"component":"@insumermodel/mppx-token-gate","cve_ids":["CVE-2026-104891"],"ecosystem":"npm","epss":0.00282,"exploited":false,"fixed_versions":["1.0.4"],"ghsa_id":"GHSA-jg6q-3qfh-r9f8","id":"tcs_01M5KFXYSPXJMCQA0N80PJHV9K","modified_at":"2026-10-07T18:15:10.729348293Z","published_at":"2026-10-07T18:03:42Z","references":["https://osv.dev/vulnerability/GHSA-jg6q-3qfh-r9f8","https://github.com/douglasborthwick-crypto/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8","https://github.com/insumerapi/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8","https://nvd.nist.gov/vuln/detail/CVE-2026-104891","https://github.com/insumerapi/mppx-condition-gate/commit/b1d9935a57ba6d32da49eead1bfb459ad0cd55ab","https://github.com/insumerapi/mppx-condition-gate/commit/ec43a2fcd443a0fa102b6d4203abed2b785bd954","https://github.com/douglasborthwick-crypto/mppx-condition-gate"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-jg6q-3qfh-r9f8#npm/@insumermodel/mppx-token-gate","url":"https://osv.dev/vulnerability/GHSA-jg6q-3qfh-r9f8"}],"summary":"mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control"}