{"action":"Upgrade hfs to 0.57.10 or later.","affected":[{"fixed":"0.57.10","introduced":"0"}],"component":"hfs","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.57.10"],"ghsa_id":"GHSA-xcxh-6cv4-q8p8","id":"tcs_01M5KGHQ9DQB0RRP915PJCRPNV","modified_at":"2025-08-12T20:23:55Z","published_at":"2025-08-12T00:13:03Z","references":["https://osv.dev/vulnerability/GHSA-xcxh-6cv4-q8p8","https://github.com/rejetto/hfs/security/advisories/GHSA-xcxh-6cv4-q8p8","https://github.com/rejetto/hfs/commit/6531bcd2ab285af88f91831e30d8a03f5b9fe20d","https://github.com/rejetto/hfs"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-xcxh-6cv4-q8p8","url":"https://osv.dev/vulnerability/GHSA-xcxh-6cv4-q8p8"}],"summary":"HFS user adding a \"web link\" in HFS is vulnerable to \"target=_blank\" exploit"}