{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.9.2"}],"component":"node-import","cve_ids":["CVE-2020-7678"],"ecosystem":"npm","epss":0.0116,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-pc62-cq5x-3j5g","id":"tcs_01M5KG3A2T4ND4QYB22GMMCG9S","modified_at":"2023-11-08T04:04:04.280992Z","published_at":"2022-07-26T00:01:05Z","references":["https://osv.dev/vulnerability/GHSA-pc62-cq5x-3j5g","https://nvd.nist.gov/vuln/detail/CVE-2020-7678","https://github.com/mahdaen/node-import","https://github.com/mahdaen/node-import/blob/master/index.js%23L79","https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-pc62-cq5x-3j5g","url":"https://osv.dev/vulnerability/GHSA-pc62-cq5x-3j5g"}],"summary":"node-import `params` argument can be controlled by users without any sanitization"}