{"action":"Upgrade prebid.js to 10.10.0 or later.","affected":[{"fixed":"10.10.0","introduced":"10.9.2"}],"component":"prebid.js","cve_ids":["CVE-2025-59038"],"ecosystem":"npm","epss":0.00351,"exploited":false,"fixed_versions":["10.10.0"],"ghsa_id":"GHSA-jwq7-6j4r-2f92","id":"tcs_01M5KFZ49NMSTHJGE07YYNNR3M","modified_at":"2025-09-12T01:42:18.787013Z","published_at":"2025-09-11T14:22:40Z","references":["https://osv.dev/vulnerability/GHSA-jwq7-6j4r-2f92","https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92","https://nvd.nist.gov/vuln/detail/CVE-2025-59038","https://github.com/prebid/Prebid.js/commit/72c7f184028f51ba15cdac744d56590b0f2b1f1e","https://github.com/prebid/Prebid.js","https://github.com/prebid/Prebid.js/releases/tag/10.10.0","https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-jwq7-6j4r-2f92","url":"https://osv.dev/vulnerability/GHSA-jwq7-6j4r-2f92"},{"source":"nvd","source_id":"CVE-2025-59038","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59038"}],"summary":"Prebid.js NPM package briefly compromised"}