{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.1.0"}],"component":"markdown-it-toc","cve_ids":["CVE-2020-28455"],"ecosystem":"npm","epss":0.00614,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wfvx-fx73-3rfj","id":"tcs_01M5KGEYGF45ME1HHPFHZD6NSQ","modified_at":"2023-11-08T04:03:27.019087Z","published_at":"2022-07-26T00:01:05Z","references":["https://osv.dev/vulnerability/GHSA-wfvx-fx73-3rfj","https://nvd.nist.gov/vuln/detail/CVE-2020-28455","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITTOC-1044067"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-wfvx-fx73-3rfj","url":"https://osv.dev/vulnerability/GHSA-wfvx-fx73-3rfj"}],"summary":"markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped"}