{"action":"Upgrade wetty to 3.0.4 or later.","affected":[{"fixed":"3.0.4","introduced":"0"}],"component":"wetty","cve_ids":["CVE-2026-49864"],"ecosystem":"npm","epss":0.00444,"exploited":false,"fixed_versions":["3.0.4"],"ghsa_id":"GHSA-p26j-h7wj-r568","id":"tcs_01M5KG252R7JAZ0NX6FGKP8DCJ","modified_at":"2026-07-01T18:41:31.700322Z","published_at":"2026-07-01T18:19:39Z","references":["https://osv.dev/vulnerability/GHSA-p26j-h7wj-r568","https://github.com/butlerx/wetty/security/advisories/GHSA-p26j-h7wj-r568","https://github.com/butlerx/wetty"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-p26j-h7wj-r568","url":"https://osv.dev/vulnerability/GHSA-p26j-h7wj-r568"},{"source":"nvd","source_id":"CVE-2026-49864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49864"}],"summary":"wetty vulnerable to DOM XSS via file-download filename"}