{"action":"Upgrade @tryghost/members-csv to 5.82.0 or later.","affected":[{"fixed":"5.82.0","introduced":"0"}],"component":"@tryghost/members-csv","cve_ids":["CVE-2024-34448"],"ecosystem":"npm","epss":0.00729,"exploited":false,"fixed_versions":["5.82.0"],"ghsa_id":"GHSA-xgwh-cgv9-783v","id":"tcs_01M5KGJ1J3KKJYMTVFREEPGBJQ","modified_at":"2025-04-19T08:13:00.736657Z","published_at":"2024-05-22T18:30:40Z","references":["https://osv.dev/vulnerability/GHSA-xgwh-cgv9-783v","https://nvd.nist.gov/vuln/detail/CVE-2024-34448","https://github.com/TryGhost/Ghost/commit/de668e7950a019a204b2df0c84596ea0fa32cce6","https://github.com/TryGhost/Ghost","https://github.com/phulelouch/CVEs/blob/main/CVE-2024-34448.md"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-xgwh-cgv9-783v","url":"https://osv.dev/vulnerability/GHSA-xgwh-cgv9-783v"}],"summary":"Ghost allows CSV Injection during member CSV export"}