{"action":"Upgrade @tak-ps/cloudtak to 13.10.0 or later.","affected":[{"fixed":"13.10.0","introduced":"0"}],"component":"@tak-ps/cloudtak","cve_ids":["CVE-2026-55177"],"ecosystem":"npm","epss":0.0038,"exploited":false,"fixed_versions":["13.10.0"],"ghsa_id":"GHSA-r95q-fp26-h3hc","id":"tcs_01M5KG8J50322XD0R3WMXD1T4E","modified_at":"2026-07-17T21:56:43.644423Z","published_at":"2026-07-17T21:35:10Z","references":["https://osv.dev/vulnerability/GHSA-r95q-fp26-h3hc","https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-r95q-fp26-h3hc","https://github.com/dfpc-coe/CloudTAK","https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.10.0"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-r95q-fp26-h3hc","url":"https://osv.dev/vulnerability/GHSA-r95q-fp26-h3hc"},{"source":"nvd","source_id":"CVE-2026-55177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55177"}],"summary":"CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard"}