{"action":"Upgrade @metamask/sdk-react to 0.33.1 or later.","affected":[{"fixed":"0.33.1","introduced":"0.16.0"}],"component":"@metamask/sdk-react","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.33.1"],"ghsa_id":"GHSA-qj3p-xc97-xw74","id":"tcs_01M5KG6AP4H9YPN1YVVT4MPNRG","modified_at":"2025-09-15T13:55:56Z","published_at":"2025-09-15T13:55:56Z","references":["https://osv.dev/vulnerability/GHSA-qj3p-xc97-xw74","https://github.com/MetaMask/metamask-sdk/security/advisories/GHSA-qj3p-xc97-xw74","https://github.com/MetaMask/metamask-sdk/pull/1342","https://github.com/MetaMask/metamask-sdk/commit/baa185c6cfa97755a3d389d956372ad9eb37c4a4","https://github.com/MetaMask/metamask-sdk"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-qj3p-xc97-xw74#npm/@metamask/sdk-react","url":"https://osv.dev/vulnerability/GHSA-qj3p-xc97-xw74"}],"summary":"MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency"}