{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.2.0"}],"component":"connect-multiparty","cve_ids":["CVE-2022-29623"],"ecosystem":"npm","epss":0.01384,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-w2xw-44r3-4v9g","id":"tcs_01M5KGDKT173SF59VGCW28CN3J","modified_at":"2025-05-20T20:13:27.434378Z","published_at":"2022-05-17T00:01:45Z","references":["https://osv.dev/vulnerability/GHSA-w2xw-44r3-4v9g","https://nvd.nist.gov/vuln/detail/CVE-2022-29623","https://github.com/expressjs/connect-multiparty","https://github.com/expressjs/connect-multiparty/releases/tag/2.2.0","https://www.npmjs.com/package/connect-multiparty","https://www.youtube.com/watch?v=i3xJR-91rrM"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-w2xw-44r3-4v9g","url":"https://osv.dev/vulnerability/GHSA-w2xw-44r3-4v9g"}],"summary":"Connect-Multiparty allows arbitrary file upload"}