{"action":"Upgrade fava to 1.22.3 or later.","affected":[{"fixed":"1.22.3","introduced":"0"}],"component":"fava","cve_ids":["CVE-2022-2589"],"ecosystem":"PyPI","epss":0.00752,"exploited":false,"fixed_versions":["1.22.3"],"ghsa_id":"GHSA-6hcj-qrw3-m66q","id":"tcs_01M5KGGRHFCTD58FFD9ECYEDPR","modified_at":"2023-11-08T04:08:50.835388Z","published_at":"2022-08-01T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-246","https://huntr.dev/bounties/8705800d-cf2f-433d-9c3e-dbef6a3f7e08","https://github.com/beancount/fava/commit/68bbb6e39319deb35ab9f18d0b6aa9fa70472539","https://github.com/advisories/GHSA-6hcj-qrw3-m66q"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-246","url":"https://osv.dev/vulnerability/PYSEC-2022-246"}],"summary":"Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3."}