{"action":"Upgrade shuup to 2.11.0 or later.","affected":[{"fixed":"2.11.0","introduced":"0.4.2"}],"component":"shuup","cve_ids":["CVE-2021-25962"],"ecosystem":"PyPI","epss":0.01094,"exploited":false,"fixed_versions":["2.11.0"],"ghsa_id":"GHSA-663j-rjcr-789f","id":"tcs_01M5KGCJ26F26S7GR6Q7B8RQ4Z","modified_at":"2023-11-08T04:05:18.943712Z","published_at":"2021-09-29T14:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-355","https://github.com/shuup/shuup/commit/0a2db392e8518410c282412561461cd8797eea51","https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25962","https://github.com/advisories/GHSA-663j-rjcr-789f"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-355","url":"https://osv.dev/vulnerability/PYSEC-2021-355"}],"summary":"“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a produ"}