{"action":"Upgrade @uppy/companion to 3.1.5 or later.","affected":[{"fixed":"3.1.5","introduced":"0"}],"component":"@uppy/companion","cve_ids":["CVE-2022-0086"],"ecosystem":"npm","epss":0.01246,"exploited":false,"fixed_versions":["3.1.5"],"ghsa_id":"GHSA-x8rq-rc7x-5fg5","id":"tcs_01M5KGHE40804GBN43B6P2M1Q6","modified_at":"2025-12-22T18:10:38.554016Z","published_at":"2022-01-06T22:24:35Z","references":["https://osv.dev/vulnerability/GHSA-x8rq-rc7x-5fg5","https://nvd.nist.gov/vuln/detail/CVE-2022-0086","https://github.com/transloadit/uppy/pull/3403","https://github.com/transloadit/uppy/commit/fc137e30a2a3102eb191141f280d5de20dacdf8f","https://github.com/transloadit/uppy","https://github.com/transloadit/uppy/releases/tag/uppy%402.3.3","https://huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-x8rq-rc7x-5fg5","url":"https://osv.dev/vulnerability/GHSA-x8rq-rc7x-5fg5"}],"summary":"uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)"}