{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.2.2"}],"component":"markdown-it-decorate","cve_ids":["CVE-2020-28459"],"ecosystem":"npm","epss":0.00614,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-rhf5-2378-3w3w","id":"tcs_01M5KG95CXDX4X7FWFN66196A0","modified_at":"2023-11-08T04:03:27.139013Z","published_at":"2022-07-19T14:16:06Z","references":["https://osv.dev/vulnerability/GHSA-rhf5-2378-3w3w","https://nvd.nist.gov/vuln/detail/CVE-2020-28459","https://github.com/rstacruz/markdown-it-decorate/commit/a6b33ce79e9b8cddf6184c754713e6af65253909","https://github.com/rstacruz/markdown-it-decorate","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITDECORATE-1044068"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-rhf5-2378-3w3w","url":"https://osv.dev/vulnerability/GHSA-rhf5-2378-3w3w"}],"summary":"markdown-it-decorate vulnerable to cross-site scripting (XSS)"}