{"action":"Upgrade aurelia-framework to 1.4.1 or later.","affected":[{"fixed":"1.4.1","introduced":"0"}],"component":"aurelia-framework","cve_ids":["CVE-2019-10062"],"ecosystem":"npm","epss":0.01416,"exploited":false,"fixed_versions":["1.4.1"],"ghsa_id":"GHSA-m6j2-v3gq-45r5","id":"tcs_01M5KFZVD6E0SGXQ64EJP2QCME","modified_at":"2023-11-08T04:00:39.374136Z","published_at":"2022-02-10T23:42:39Z","references":["https://osv.dev/vulnerability/GHSA-m6j2-v3gq-45r5","https://nvd.nist.gov/vuln/detail/CVE-2019-10062","https://github.com/aurelia/framework/issues/992","https://discourse.aurelia.io/t/xss-vulnerability-in-htmlsanitizer-might-be-insufficiently-handled/4219","https://github.com/aurelia/framework","https://github.com/aurelia/templating-resources/blob/0cef07a8cac8e99146d8e1c4b734491bb3dc4724/src/html-sanitizer.js","https://www.gosecure.net/blog/2021/05/12/aurelia-framework-insecure-default-allows-xss"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-m6j2-v3gq-45r5","url":"https://osv.dev/vulnerability/GHSA-m6j2-v3gq-45r5"}],"summary":"Cross-site Scripting in aurelia-framework"}