{"action":"Upgrade papermerge to 1.5.2 or later.","affected":[{"fixed":"1.5.2","introduced":"1.2.0"}],"component":"papermerge","cve_ids":["CVE-2020-29456"],"ecosystem":"PyPI","epss":0.01559,"exploited":false,"fixed_versions":["1.5.2"],"ghsa_id":"GHSA-9w49-m7xh-5r39","id":"tcs_01M5KGAVM0CP6HJ7XVDDRG7T5W","modified_at":"2023-11-08T04:03:31.169710Z","published_at":"2020-12-02T08:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-74","https://github.com/ciur/papermerge/issues/228","https://www.papermerge.com/","https://github.com/ciur/papermerge/releases/tag/v1.5.2","https://github.com/advisories/GHSA-9w49-m7xh-5r39"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-74","url":"https://osv.dev/vulnerability/PYSEC-2020-74"}],"summary":"Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The"}