{"action":"Upgrade marshmallow to 2.15.1 or later.","affected":[{"fixed":"2.15.1","introduced":"0"},{"fixed":"3.0.0b9","introduced":"3.0a0"}],"component":"marshmallow","cve_ids":["CVE-2018-17175"],"ecosystem":"PyPI","epss":0.01919,"exploited":false,"fixed_versions":["2.15.1","3.0.0b9"],"ghsa_id":"GHSA-9q2p-fj49-vpxj","id":"tcs_01M5KG844HY4GBBW2T8S29CNZ4","modified_at":"2023-11-08T04:00:03.100972Z","published_at":"2018-09-18T17:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-67","https://github.com/marshmallow-code/marshmallow/pull/782","https://github.com/marshmallow-code/marshmallow/pull/777","https://github.com/marshmallow-code/marshmallow/issues/772","https://github.com/advisories/GHSA-9q2p-fj49-vpxj"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2018-67","url":"https://osv.dev/vulnerability/PYSEC-2018-67"}],"summary":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expo"}