{"action":"Upgrade @cap-js/openapi to 1.4.2 or later.","affected":[{"fixed":"1.4.2","introduced":"1.4.1"}],"component":"@cap-js/openapi","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.4.2"],"ghsa_id":"GHSA-jpvj-wpmj-h7rv","id":"tcs_01M5KFYM9JSG0EJSTHB8HW3AD4","modified_at":"2026-09-10T03:51:08.781296937Z","published_at":"2026-06-04T19:37:04Z","references":["https://osv.dev/vulnerability/GHSA-jpvj-wpmj-h7rv","https://github.com/cap-js/openapi/security/advisories/GHSA-jpvj-wpmj-h7rv","https://github.com/cap-js/openapi","https://me.sap.com/notes/3747787","https://www.sap.com/documents/2026/05/8203a8b9-4d7f-0010-bca6-c68f7e60039b.html"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-jpvj-wpmj-h7rv","url":"https://osv.dev/vulnerability/GHSA-jpvj-wpmj-h7rv"}],"summary":"Supply chain compromise via malicious @cap-js/openapi"}