{"action":"Upgrade aws-sdk to 2.814.0 or later.","affected":[{"fixed":"2.814.0","introduced":"0"}],"component":"aws-sdk","cve_ids":["CVE-2020-28472"],"ecosystem":"npm","epss":0.02168,"exploited":false,"fixed_versions":["2.814.0"],"ghsa_id":"GHSA-rrc9-gqf8-8rwg","id":"tcs_01M5KG9RH9HRYCMMDTVKPXBXGN","modified_at":"2025-01-14T08:57:08.927770Z","published_at":"2021-11-16T21:26:43Z","references":["https://osv.dev/vulnerability/GHSA-rrc9-gqf8-8rwg","https://nvd.nist.gov/vuln/detail/CVE-2020-28472","https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611","https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425","https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424","https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-rrc9-gqf8-8rwg","url":"https://osv.dev/vulnerability/GHSA-rrc9-gqf8-8rwg"}],"summary":"Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader"}