{"action":"Upgrade @vendure/core to 2.1.3 or later.","affected":[{"fixed":"2.1.3","introduced":"0"}],"component":"@vendure/core","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.1.3"],"ghsa_id":"GHSA-wm63-7627-ch33","id":"tcs_01M5KGFBFHVVEAF033Q1Q0QSF0","modified_at":"2023-11-17T21:50:31Z","published_at":"2023-11-17T21:50:31Z","references":["https://osv.dev/vulnerability/GHSA-wm63-7627-ch33","https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-wm63-7627-ch33","https://github.com/vendure-ecommerce/vendure/commit/5e506fd8ba9f7e20030c329e62af1140d906121f","https://github.com/vendure-ecommerce/vendure"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-wm63-7627-ch33","url":"https://osv.dev/vulnerability/GHSA-wm63-7627-ch33"}],"summary":"@vendure/core's insecure currencyCode handling allows wrong payment amounts"}