{"action":"Upgrade @scullyio/ng-lib to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0"}],"component":"@scullyio/ng-lib","cve_ids":["CVE-2020-28470"],"ecosystem":"npm","epss":0.00835,"exploited":false,"fixed_versions":["1.0.1"],"ghsa_id":"GHSA-r96p-v3cr-gfv8","id":"tcs_01M5KG8K7EE4863PVPMR1V6TF0","modified_at":"2026-03-13T21:57:08.672477Z","published_at":"2021-04-13T15:28:01Z","references":["https://osv.dev/vulnerability/GHSA-r96p-v3cr-gfv8","https://nvd.nist.gov/vuln/detail/CVE-2020-28470","https://github.com/scullyio/scully/pull/1182","https://github.com/scullyio/scully","https://snyk.io/vuln/SNYK-JS-SCULLYIOSCULLY-1055829"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-r96p-v3cr-gfv8#npm/@scullyio/ng-lib","url":"https://osv.dev/vulnerability/GHSA-r96p-v3cr-gfv8"}],"summary":"Cross-site Scripting (XSS) in @scullyio/scully"}