{"action":"Upgrade pyarchery to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"0"}],"component":"pyarchery","cve_ids":["CVE-2019-20008"],"ecosystem":"PyPI","epss":0.00916,"exploited":false,"fixed_versions":["1.3.0"],"id":"tcs_01M5KG8CW4BK0R29E2JPCK3PY9","modified_at":"2023-11-08T04:01:30.020778Z","published_at":"2019-12-26T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-112","https://github.com/archerysec/archerysec/issues/338","https://github.com/archerysec/archerysec/compare/archerysec-v1.2...v1.3","https://github.com/archerysec/archerysec/releases/tag/v1.3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-112","url":"https://osv.dev/vulnerability/PYSEC-2019-112"}],"summary":"In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page."}