{"action":"Upgrade @graphql-mesh/runtime to 0.96.9 or later.","affected":[{"fixed":"0.96.9","introduced":"0.96.5"}],"component":"@graphql-mesh/runtime","cve_ids":["CVE-2025-27097"],"ecosystem":"npm","epss":0.00432,"exploited":false,"fixed_versions":["0.96.9"],"ghsa_id":"GHSA-rr4x-crhf-8886","id":"tcs_01M5KG9QK4KJBSX355ENFSE3CZ","modified_at":"2025-02-20T23:12:14.566284Z","published_at":"2023-10-10T21:29:50Z","references":["https://osv.dev/vulnerability/GHSA-rr4x-crhf-8886","https://github.com/Urigo/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886","https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886","https://nvd.nist.gov/vuln/detail/CVE-2025-27097","https://github.com/Urigo/graphql-mesh/commit/482d813a9f75935024aa77872125d197f5fca3d0","https://github.com/Urigo/graphql-mesh","https://github.com/Urigo/graphql-mesh/releases/tag/release-1696859949678"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-rr4x-crhf-8886","url":"https://osv.dev/vulnerability/GHSA-rr4x-crhf-8886"},{"source":"nvd","source_id":"CVE-2025-27097","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27097"}],"summary":"Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation"}