{"action":"Upgrade antilles-tools to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0"}],"component":"antilles-tools","cve_ids":["CVE-2021-3840"],"ecosystem":"PyPI","epss":0.02036,"exploited":false,"fixed_versions":["1.0.1"],"ghsa_id":"GHSA-hgc3-hp6x-wpgx","id":"tcs_01M5KGFJDCZQSZKZ019MRHFTMQ","modified_at":"2023-11-08T04:06:27.573601Z","published_at":"2021-11-12T22:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-840","https://github.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-840","url":"https://osv.dev/vulnerability/PYSEC-2021-840"}],"summary":"A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in"}