{"action":"Upgrade cached-path-relative to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"cached-path-relative","cve_ids":["CVE-2021-23518"],"ecosystem":"npm","epss":0.01943,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-wg6g-ppvx-927h","id":"tcs_01M5KGEZRSB7SJZ35087653WDR","modified_at":"2025-01-14T09:12:17.995903Z","published_at":"2022-01-27T14:27:53Z","references":["https://osv.dev/vulnerability/GHSA-wg6g-ppvx-927h","https://nvd.nist.gov/vuln/detail/CVE-2021-23518","https://github.com/ashaffer/cached-path-relative/commit/40c73bf70c58add5aec7d11e4f36b93d144bb760","https://github.com/ashaffer/cached-path-relative","https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2348246","https://snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-2342653"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-wg6g-ppvx-927h","url":"https://osv.dev/vulnerability/GHSA-wg6g-ppvx-927h"}],"summary":"Prototype Pollution in cached-path-relative"}