{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.11.2"}],"component":"nextchat","cve_ids":["CVE-2023-49785"],"ecosystem":"npm","epss":0.83163,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qf3q-9f3h-cjp9","id":"tcs_01M5KG5YYKG6WM15MW38FAKGP1","modified_at":"2024-08-05T21:58:56.944712Z","published_at":"2024-08-05T21:29:23Z","references":["https://osv.dev/vulnerability/GHSA-qf3q-9f3h-cjp9","https://nvd.nist.gov/vuln/detail/CVE-2023-49785","https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web","https://www.horizon3.ai/attack-research/attack-blogs/nextchat-an-ai-chatbot-that-lets-you-talk-to-anyone-you-want-to"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-qf3q-9f3h-cjp9","url":"https://osv.dev/vulnerability/GHSA-qf3q-9f3h-cjp9"}],"summary":"NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint"}