{"action":"Upgrade icu-minify to 4.9.2 or later.","affected":[{"fixed":"4.9.2","introduced":"0"}],"component":"icu-minify","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["4.9.2"],"ghsa_id":"GHSA-r27j-894h-3w3p","id":"tcs_01M5KG7K8JXCP4APHP3DKZ3NDB","modified_at":"2026-05-06T17:48:37.576211Z","published_at":"2026-05-06T17:32:01Z","references":["https://osv.dev/vulnerability/GHSA-r27j-894h-3w3p","https://github.com/amannn/next-intl/security/advisories/GHSA-r27j-894h-3w3p","https://github.com/amannn/next-intl"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-r27j-894h-3w3p","url":"https://osv.dev/vulnerability/GHSA-r27j-894h-3w3p"}],"summary":"mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`"}