{"action":"No fix published. Pin and monitor.","affected":[],"component":"vditor","cve_ids":["CVE-2024-34449"],"ecosystem":"npm","epss":0.00359,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-m5jf-8crm-r65m","id":"tcs_01M5KFZMWKFQ902ADKS39E3SAY","modified_at":"2024-05-03T20:56:45.054437Z","published_at":"2024-05-03T18:30:37Z","references":["https://osv.dev/vulnerability/GHSA-m5jf-8crm-r65m","https://nvd.nist.gov/vuln/detail/CVE-2024-34449","https://github.com/Vanessa219/vditor/issues/1604","https://github.com/Vanessa219/vditor","https://github.com/Vanessa219/vditor/blob/b3a14d6e4462b0c17141e1fcc66173264ada64e0/README_en_US.md?plain=1#L310"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-m5jf-8crm-r65m","url":"https://osv.dev/vulnerability/GHSA-m5jf-8crm-r65m"}],"summary":"Vditor allows Cross-site Scripting via an attribute of an `A` element"}