{"action":"Upgrade @thi.ng/egf to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"@thi.ng/egf","cve_ids":["CVE-2021-21412"],"ecosystem":"npm","epss":0.01339,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-rj44-gpjc-29r7","id":"tcs_01M5KG9879BBW0BR4T3S3EAX54","modified_at":"2026-07-08T06:29:39.326519201Z","published_at":"2021-04-06T17:22:41Z","references":["https://osv.dev/vulnerability/GHSA-rj44-gpjc-29r7","https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7","https://nvd.nist.gov/vuln/detail/CVE-2021-21412","https://github.com/thi-ng/umbrella/commit/88f61656e5f5cfba960013b8133186389efaf243","https://github.com/thi-ng/umbrella/blob/develop/packages/egf/CHANGELOG.md#040-2021-03-27","https://www.npmjs.com/package/@thi.ng/egf"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-rj44-gpjc-29r7","url":"https://osv.dev/vulnerability/GHSA-rj44-gpjc-29r7"}],"summary":"[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values"}