{"action":"Upgrade @yaireo/tagify to 4.9.8 or later.","affected":[{"fixed":"4.9.8","introduced":"0"}],"component":"@yaireo/tagify","cve_ids":["CVE-2022-25854"],"ecosystem":"npm","epss":0.00992,"exploited":false,"fixed_versions":["4.9.8"],"ghsa_id":"GHSA-pxpf-v376-7xx5","id":"tcs_01M5KG4RJ63HN1GDGHBKZGNHZN","modified_at":"2026-07-08T06:49:35.540099993Z","published_at":"2022-04-30T00:00:33Z","references":["https://osv.dev/vulnerability/GHSA-pxpf-v376-7xx5","https://nvd.nist.gov/vuln/detail/CVE-2022-25854","https://github.com/yairEO/tagify/issues/988","https://github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7","https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module","https://github.com/yairEO/tagify","https://github.com/yairEO/tagify/releases/tag/v4.9.8","https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-pxpf-v376-7xx5","url":"https://osv.dev/vulnerability/GHSA-pxpf-v376-7xx5"}],"summary":"tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload"}