{"action":"Upgrade cocotais-bot to 1.6.2 or later.","affected":[{"fixed":"1.6.2","introduced":"1.5.0-test2-hotfix"}],"component":"cocotais-bot","cve_ids":["CVE-2025-47948"],"ecosystem":"npm","epss":0.00411,"exploited":false,"fixed_versions":["1.6.2"],"ghsa_id":"GHSA-mj2c-8hxf-ffvq","id":"tcs_01M5KG0VPBCTP59B0GN6Y5V0QX","modified_at":"2026-09-10T03:50:57.596478108Z","published_at":"2025-05-19T16:25:05Z","references":["https://osv.dev/vulnerability/GHSA-mj2c-8hxf-ffvq","https://github.com/cocotais/cocotais-bot/security/advisories/GHSA-mj2c-8hxf-ffvq","https://nvd.nist.gov/vuln/detail/CVE-2025-47948","https://github.com/cocotais/cocotais-bot/commit/d1cf01a9a41b3131241d1833444b890c8d6e70b8","https://github.com/cocotais/cocotais-bot"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-mj2c-8hxf-ffvq","url":"https://osv.dev/vulnerability/GHSA-mj2c-8hxf-ffvq"}],"summary":"Cocotais Bot has builtin .echo command injection"}