{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.1"}],"component":"keep-module-latest","cve_ids":["CVE-2023-26128"],"ecosystem":"npm","epss":0.01188,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wxrx-pc44-rcgc","id":"tcs_01M5KGGD89TBX7P19NMA1QWZ55","modified_at":"2025-01-14T15:52:06Z","published_at":"2023-05-27T06:30:41Z","references":["https://osv.dev/vulnerability/GHSA-wxrx-pc44-rcgc","https://nvd.nist.gov/vuln/detail/CVE-2023-26128","https://github.com/liujunyang/keep-module-latest","https://github.com/liujunyang/keep-module-latest/blob/master/index.js%23L50","https://security.snyk.io/vuln/SNYK-JS-KEEPMODULELATEST-3157165"],"severity":{"label":"high","score":8.4},"sources":[{"source":"osv","source_id":"GHSA-wxrx-pc44-rcgc","url":"https://osv.dev/vulnerability/GHSA-wxrx-pc44-rcgc"}],"summary":"keep-module-latest vulnerable to Command Injection due to missing input sanitization"}