{"action":"Upgrade github.com/tobychui/zoraxy to 3.1.3+incompatible or later.","affected":[{"fixed":"3.1.3+incompatible","introduced":"0"}],"component":"github.com/tobychui/zoraxy","cve_ids":["CVE-2024-52010"],"ecosystem":"Go","epss":0.01503,"exploited":false,"fixed_versions":["3.1.3+incompatible"],"ghsa_id":"GHSA-7hpf-g48v-hw3j","id":"tcs_01M5KG6070SRMG32FYM1ZQMD40","modified_at":"2024-11-19T17:42:36.463369Z","published_at":"2024-11-19T17:20:31Z","references":["https://osv.dev/vulnerability/GO-2024-3267","https://github.com/tobychui/zoraxy/security/advisories/GHSA-7hpf-g48v-hw3j","https://nvd.nist.gov/vuln/detail/CVE-2024-52010","https://github.com/tobychui/zoraxy/commit/2e9bc77a5d832bff1093058d42ce7a61382e4bc6","https://github.com/tobychui/zoraxy/commit/c07d5f85dfc37bd32819358ed7d4bc32c604e8f0"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GO-2024-3267","url":"https://osv.dev/vulnerability/GO-2024-3267"},{"source":"nvd","source_id":"CVE-2024-52010","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52010"}],"summary":"Zoraxy has an authenticated command injection in the Web SSH feature in github.com/tobychui/zoraxy"}