{"action":"Upgrade @saltcorn/cli to 0.8.8-beta.2 or later.","affected":[{"fixed":"0.8.8-beta.2","introduced":"0"}],"component":"@saltcorn/cli","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.8.8-beta.2"],"ghsa_id":"GHSA-wxf3-4fvj-vqqx","id":"tcs_01M5KGGA1M9ANEBR1NVYRS8MAT","modified_at":"2026-02-03T03:12:28.153627Z","published_at":"2023-07-27T19:28:02Z","references":["https://osv.dev/vulnerability/GHSA-wxf3-4fvj-vqqx","https://github.com/saltcorn/saltcorn/security/advisories/GHSA-wxf3-4fvj-vqqx","https://github.com/saltcorn/saltcorn/pull/1973","https://github.com/saltcorn/saltcorn/commit/0f32a51277a635c814a634bda9b6d358fb8c04ab","https://github.com/saltcorn/saltcorn","https://github.com/saltcorn/saltcorn/blob/99fe277e497fd193bb070acd8c663aa254a9907c/packages/server/load_plugins.js#L191"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-wxf3-4fvj-vqqx","url":"https://osv.dev/vulnerability/GHSA-wxf3-4fvj-vqqx"}],"summary":"Unsafe plugins can be installed via pack import by tenant admins"}