{"action":"Upgrade mxgraph to 3.7.6 or later.","affected":[{"fixed":"3.7.6","introduced":"0"}],"component":"mxgraph","cve_ids":["CVE-2017-18197"],"ecosystem":"npm","epss":0.02899,"exploited":false,"fixed_versions":["3.7.6"],"ghsa_id":"GHSA-wvpv-8524-wg6x","id":"tcs_01M5KGG2J1S9B4Y85K8M3WQNBS","modified_at":"2023-11-08T03:59:15.313407Z","published_at":"2022-05-14T03:38:59Z","references":["https://osv.dev/vulnerability/GHSA-wvpv-8524-wg6x","https://nvd.nist.gov/vuln/detail/CVE-2017-18197","https://github.com/jgraph/mxgraph/issues/124","https://github.com/jgraph/mxgraph/commit/97b3718db64a6ca9afb3382de2926eb8da660052","https://github.com/jgraph/mxgraph","https://lists.debian.org/debian-lts-announce/2018/03/msg00002.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-wvpv-8524-wg6x","url":"https://osv.dev/vulnerability/GHSA-wvpv-8524-wg6x"}],"summary":"mxGraph vulnerable to XXE attacks"}