{"action":"Upgrade auth0-lock to 11.21.0 or later.","affected":[{"fixed":"11.21.0","introduced":"0"}],"component":"auth0-lock","cve_ids":["CVE-2019-20174"],"ecosystem":"npm","epss":0.00724,"exploited":false,"fixed_versions":["11.21.0"],"ghsa_id":"GHSA-w2pf-g6r8-pg22","id":"tcs_01M5KGDJGH24763EFVC7QK1XGX","modified_at":"2023-11-08T04:01:30.142727Z","published_at":"2020-01-31T17:59:51Z","references":["https://osv.dev/vulnerability/GHSA-w2pf-g6r8-pg22","https://github.com/auth0/lock/security/advisories/GHSA-w2pf-g6r8-pg22","https://nvd.nist.gov/vuln/detail/CVE-2019-20174","https://github.com/auth0/lock/commit/6c15e5659c21cd814ea119af5c51b61399598dd5","https://auth0.com/docs/security/bulletins/cve-2019-20174","https://github.com/auth0/lock/releases/tag/v11.21.0"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-w2pf-g6r8-pg22","url":"https://osv.dev/vulnerability/GHSA-w2pf-g6r8-pg22"}],"summary":"auth0-lock vulnerable to XSS via unsanitized placeholder property"}