{"action":"Upgrade json2xml to 3.14.0 or later.","affected":[{"fixed":"3.14.0","introduced":"0"}],"component":"json2xml","cve_ids":["CVE-2022-25024"],"ecosystem":"PyPI","epss":0.0131,"exploited":false,"fixed_versions":["3.14.0"],"ghsa_id":"GHSA-8rj5-2857-877j","id":"tcs_01M5KGJHJK54Q70KJA74EBY995","modified_at":"2026-06-10T17:01:49.390786286Z","published_at":"2023-08-22T19:16:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-149","https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads/","https://github.com/vinitkumar/json2xml/pull/107/files","https://github.com/vinitkumar/json2xml/pull/107","https://github.com/vinitkumar/json2xml/issues/106","https://github.com/advisories/GHSA-8rj5-2857-877j"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-149","url":"https://osv.dev/vulnerability/PYSEC-2023-149"}],"summary":"The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service."}