{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.8.3"}],"component":"decap-cms","cve_ids":["CVE-2025-57520"],"ecosystem":"npm","epss":0.00334,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-xp8g-32qh-mv28","id":"tcs_01M5KGJF8ZZ8DJV9JBNGKH2CTP","modified_at":"2025-09-23T20:24:42Z","published_at":"2025-09-10T18:30:16Z","references":["https://osv.dev/vulnerability/GHSA-xp8g-32qh-mv28","https://nvd.nist.gov/vuln/detail/CVE-2025-57520","https://github.com/decaporg/decap-cms","https://onurcangenc.com.tr/posts/cve-2025-57520--stored-xss-in-decap-cms-3-8-3"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-xp8g-32qh-mv28","url":"https://osv.dev/vulnerability/GHSA-xp8g-32qh-mv28"}],"summary":"Decap CMS Cross Site Scripting (XSS) vulnerability"}