{"action":"Upgrade python-cjson to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"python-cjson","cve_ids":["CVE-2009-4924"],"ecosystem":"PyPI","epss":0.01354,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-95jp-77w6-qj52","id":"tcs_01M5KG5CAWYRCHM00KZ4DV4E7X","modified_at":"2023-11-08T03:56:54.492097Z","published_at":"2010-07-02T19:30:00Z","references":["https://osv.dev/vulnerability/PYSEC-2010-26","http://t3.dotgnu.info/blog/insecurity/quotes-dont-help.html","http://pypi.python.org/pypi/python-cjson/","https://github.com/advisories/GHSA-95jp-77w6-qj52"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2010-26","url":"https://osv.dev/vulnerability/PYSEC-2010-26"}],"summary":"Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firef"}