{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.0.5"}],"component":"ffmpeg-sdk","cve_ids":["CVE-2020-28435"],"ecosystem":"npm","epss":0.01367,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-rwvf-c3wm-qm6w","id":"tcs_01M5KGA5MGTK3QB57XFTKVY586","modified_at":"2023-11-08T04:03:25.986783Z","published_at":"2022-07-26T00:01:06Z","references":["https://osv.dev/vulnerability/GHSA-rwvf-c3wm-qm6w","https://nvd.nist.gov/vuln/detail/CVE-2020-28435","https://github.com/CubetLabs/ffmpeg-sdk/blob/master/index.js","https://github.com/shajanjp/ffmpeg-sdk/blob/master/index.js","https://security.snyk.io/vuln/SNYK-JS-FFMPEGSDK-1050429"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-rwvf-c3wm-qm6w","url":"https://osv.dev/vulnerability/GHSA-rwvf-c3wm-qm6w"}],"summary":"ffmpeg-sdk vulnerable to OS Command Injection"}