{"action":"Upgrade cookiecutter to 2.1.1 or later.","affected":[{"fixed":"2.1.1","introduced":"0"}],"component":"cookiecutter","cve_ids":["CVE-2022-24065"],"ecosystem":"PyPI","epss":0.04201,"exploited":false,"fixed_versions":["2.1.1"],"ghsa_id":"GHSA-f4q6-9qm4-h8j4","id":"tcs_01M5KGGGQ6QNH7G0RCNHEMP8HR","modified_at":"2023-11-08T04:08:29.124993Z","published_at":"2022-06-08T08:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-204","https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281","https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77","https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1","https://github.com/advisories/GHSA-f4q6-9qm4-h8j4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-204","url":"https://osv.dev/vulnerability/PYSEC-2022-204"}],"summary":"The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed t"}